Hugging Face Transformers Code Injection Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in Hugging Face Transformers. This issue arises from the convert_config function, where user-supplied strings are not properly validated before being used to execute Python code. As a result, remote attackers can execute arbitrary code on affected installations. Exploitation requires user interaction, as the target must convert a malicious checkpoint.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, executed in the context of the current user.

Remediation

Given the nature of the vulnerability, the recommended mitigation strategy is to limit interaction with the product.