huggingface vulnerabilities

CVEs per yearBy the year they were published

1. 20233
2. 20242
3. 202515
4. 202619

Newest CVEs

• CVE-2026-57845

  Hugging Face Datasets through 5.1.0 Pickle Deserialization RCE via Pandas Builder

  huggingface · datasets

  High8.7
• CVE-2026-85670

  tokenizers BpeBuilder Buffer Overflow via merge token

  huggingface · tokenizers

  High7.1
• CVE-2026-75104

  Hugging Face Transformers Path Traversal via Checkpoint Index

  huggingface · transformers

  Medium6.8
• CVE-2026-69112

  Hugging Face Accelerate 1.14.0 Path Traversal and DoS via weight_map

  huggingface · accelerate

  Medium6.9
• CVE-2026-71281

  peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules

  huggingface · peft

  High8.8
• CVE-2026-9856

  Path Traversal in huggingface/transformers

  huggingface · huggingface/transformers

  High7.1
• CVE-2026-66007

  Datasets Path Traversal via Unsanitized file_name Metadata

  huggingface · datasets

  Medium6.9
• CVE-2026-65010

  Datasets Symlink-following Arbitrary File Write via Extractor.extract()

  huggingface · datasets

  Medium4.4
• CVE-2026-65920

  Diffusers Path Traversal via weight_map Arbitrary File Read

  huggingface · diffusers

  Medium5.3
• CVE-2026-63086

  text-generation-inference 3.3.7 SSRF via fetch_image in multimodal chat completions

  huggingface · text-generation-inference

  Medium6.9