huggingface transformers up to 5.2.x config.json AutoModelForCausalLM.from_pretrained _attn_implementation_internal missing serialization control element

Summaryinfo

A vulnerability described as problematic has been identified in huggingface transformers up to 5.2.x. This issue affects the function AutoModelForCausalLM.from_pretrained of the file config.json. Such manipulation of the argument _attn_implementation_internal leads to missing serialization control element. This vulnerability is listed as CVE-2026-4372. The attack must be carried out locally. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in huggingface transformers up to 5.2.x and classified as problematic. Affected by this issue is the function AutoModelForCausalLM.from_pretrained of the file config.json. The manipulation of the argument _attn_implementation_internal with an unknown input leads to a missing serialization control element vulnerability. Using CWE to declare the problem leads to CWE-1066. The product contains a serializable data element that does not have an associated serialization method. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious `config.json` file containing the `_attn_implementation_internal` field set to an attacker-controlled HuggingFace Hub repository ID. When a victim loads this model using the standard `AutoModelForCausalLM.from_pretrained()` API, the library downloads and executes arbitrary Python code from the attacker's repository with the victim's full OS privileges. This issue arises due to unfiltered deserialization of configuration attributes, insufficient sanitization of internal fields, and unsandboxed execution of downloaded kernels. The vulnerability bypasses the `trust_remote_code` security mechanism, is invisible to the victim, and exploits the standard documented usage pattern, making it particularly severe. Users are advised to upgrade to version 5.3.0 or later to mitigate this issue.

The advisory is shared for download at huntr.com. This vulnerability is handled as CVE-2026-4372 since 03/18/2026. The exploitation is known to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available.

By approaching the search of inurl:config.json it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 5.3.0 eliminates this vulnerability. Applying the patch a7f8e7ff37d87d1a1a0c8cf607971c607741452f is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-31598). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• huggingface

Name

• transformers

Version

• 5.0
• 5.1
• 5.2

License

• open-source

Website

• Product: https://github.com/huggingface/transformers/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion