Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe remote code execution vulnerability in the HuggingFace transformers library stems from two main issues. First, the PretrainedConfig.__init__ method in src/transformers/configuration_utils.py unsafely deserialized config.json files, allowing attackers to set the internal _attn_implementation_internal field. This field is used to specify a custom attention kernel to be loaded from the HuggingFace Hub. Second, the is_kernel function in src/transformers/integrations/hub_kernels.py, which validates the kernel source, only checked the format of the repository string and not the actual repository name. This allowed an attacker to point to a repository under their control. When a user loads a model with a malicious config.json using from_pretrained, the library would download and execute arbitrary code from the attacker's repository. The patch addresses these issues by preventing the deserialization of _attn_implementation_internal in the config and by restricting kernel loading to the official kernels-community repository in the is_kernel function.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| transformers | pip | < 5.3.0 | 5.3.0 |
