transformers has 12 CVEs on record between 2024 and 2026. 1 was published in the last 90 days. The median CVSS is 5.3 (medium). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.3
- Publish → KEV
- —
- Last 90 days
- 1 prev 1
Weakness classes
Products
- transformers 12
Worst active — by depth score
CVE-2026-4372High· 7.8HuggingFace transformers vulnerable to remote code execution55CVE-2026-9856High· 7.1A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal39CVE-2024-3568Low· 3.4Transformers Deserialization of Untrusted Data vulnerability31CVE-2025-6638Medium· 5.3Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer29CVE-2025-5197Medium· 5.3Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability29
transformers vulnerabilities
CVEs affecting transformers, newest first. Open any entry for full detail, references, and exploit status.
12 CVEsRSS
CVE-2026-9856High· 7.1A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal
A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the `save_pretrained()` methods of `PreTrainedTokenizerBase` and `ProcessorMix…
CVE-2026-4372High· 7.8PoCHuggingFace transformers vulnerable to remote code execution
HuggingFace transformers vulnerable to remote code execution
CVE-2025-6638Medium· 5.3Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer
Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer
CVE-2025-5197Medium· 5.3Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability
Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability
CVE-2025-3933Medium· 5.3Transformers is vulnerable to ReDoS attack through its DonutProcessor class
Transformers is vulnerable to ReDoS attack through its DonutProcessor class
CVE-2025-3263Medium· 5.3Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking
Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking
CVE-2025-3777Low· 3.5Transformers's Improper Input Validation vulnerability can be exploited through username injection
Transformers's Improper Input Validation vulnerability can be exploited through username injection
CVE-2025-3264Medium· 5.3Transformers vulnerable to ReDoS attack through its get_imports() function
Transformers vulnerable to ReDoS attack through its get_imports() function
CVE-2025-3262Medium· 5.3Transformers vulnerable to ReDoS attack through its SETTING_RE variable
Transformers vulnerable to ReDoS attack through its SETTING_RE variable
CVE-2025-1194Medium· 4.3Transformers Regular Expression Denial of Service (ReDoS) vulnerability
Transformers Regular Expression Denial of Service (ReDoS) vulnerability
CVE-2024-12720Medium· 5.3Transformers Regular Expression Denial of Service (ReDoS) vulnerability
Transformers Regular Expression Denial of Service (ReDoS) vulnerability
CVE-2024-3568Low· 3.4PoCTransformers Deserialization of Untrusted Data vulnerability
Transformers Deserialization of Untrusted Data vulnerability