A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers…

CVE-2026-4372 is a model-loading RCE in huggingface/transformers where a malicious model config.json can smuggle an internal field such as _attn_implementation_internal that points model loading toward attacker-controlled code. NVD currently says all versions before 5.3.0 are affected, while multiple secondary reports narrow practical exploitability to the newer 4.56.0 through 5.2.x line and sometimes mention the optional kernels path; absent a vendor advisory clarifying the scope, treat <5.3.0 as the safe operational boundary.

The vendor's 7.8 HIGH is directionally fair on raw impact but too generous on reachable population. This is not an unauthenticated network service bug; the attacker needs a victim workflow that fetches or opens an untrusted model, which means exposure is concentrated in ML workstations, CI jobs, GPU servers, and automated evaluation pipelines rather than your whole estate. The bypass of trust_remote_code=False is the amplifier, but the need to load hostile content is still the main friction, so this lands as MEDIUM for broad enterprise patch triage.

Why this verdict

• Downgrade for attacker position: this is not unauthenticated remote against a listening service; it requires a victim model-load event, which implies prior lure success or a permissive automation pipeline.
• Downgrade for exposed population: only hosts that both run transformers and ingest untrusted model repos are materially at risk. On a 10,000-host estate, that is usually a small ML subset, not the fleet.
• Upgrade from LOW because trust assumptions are broken: the bypass of trust_remote_code=False means normal defensive habits around 'safe model loading' are not sufficient, so impacted ML platforms deserve real urgency.
• Downgrade for current threat intel: no KEV listing, no confirmed active exploitation, and very low EPSS mean the external exploitation pressure is currently weak.
• Keep it above backlog noise because blast radius is rich: the vulnerable hosts are often GPU servers, CI runners, or data-science workstations with secrets, cloud creds, source code, and proprietary datasets.

Why not higher?

It is not higher because the exploit chain is gated by user or pipeline behavior: somebody has to load a malicious model, and many enterprises already restrict public model intake. There is also no strong evidence yet of active exploitation or mass scanning pressure, which matters when deciding what jumps the queue for an enterprise patch calendar.

Why not lower?

It is not lower because the end state is still arbitrary code execution on high-value AI infrastructure under routine documented usage. The trust_remote_code bypass removes a safety assumption many teams were relying on, so affected ML assets should not be treated as mere hygiene.

1. Block untrusted model sources — Enforce publisher allowlists or internal mirrors for Hugging Face content and stop direct pulls from arbitrary public repos. For a MEDIUM verdict there is no mitigation SLA, but if these systems ingest public models today, deploy this control immediately as risk reduction while you move toward the patch.
2. Scan caches for hostile internal fields — Search downloaded or cached model config.json files for _attn_implementation_internal and _experts_implementation_internal to find likely exposure or tampering. There is no mitigation SLA — go straight to the 365-day remediation window, but do the scan early because it can uncover already-seeded artifacts.
3. Constrain model-loading runtimes — Run notebooks, CI jobs, and model-eval workers with least-privilege identities, restricted egress, read-only filesystems where possible, and short-lived credentials. This does not remove the bug, but it limits the damage if code execution fires before you fully remediate.
4. Instrument EDR on GPU and ML nodes — Make sure the hosts that actually load models have runtime telemetry and alerting for shell spawns, network fetches, and token access from Python processes. This is especially useful on research and evaluation infrastructure where package scanners alone have little visibility.

Run this on the target host, container image, notebook base image, or CI runner that may have transformers installed. Invoke it with python3 verify_cve_2026_4372.py or point it at an alternate cache root with HF_HOME=/srv/hf-cache python3 verify_cve_2026_4372.py; no admin rights are required, but the script only inspects locations the current user can read.

#!/usr/bin/env python3
"""
verify_cve_2026_4372.py

Checks for vulnerable Hugging Face transformers versions and scans common
Hugging Face cache locations for suspicious internal config fields related to
CVE-2026-4372.

Outputs one of:
  VULNERABLE - vulnerable version present and/or suspicious cached configs found
  PATCHED    - transformers installed at >= 5.3.0 and no suspicious configs found
  UNKNOWN    - transformers not installed, version unreadable, or no readable evidence

Exit codes:
  0 = PATCHED
  1 = VULNERABLE
  2 = UNKNOWN
"""

import json
import os
import re
import sys
from pathlib import Path

TARGET_VERSION = (5, 3, 0)
SUSPICIOUS_KEYS = {"_attn_implementation_internal", "_experts_implementation_internal"}


def parse_version(v):
    nums = re.findall(r"\d+", str(v))
    if len(nums) < 3:
        nums += ["0"] * (3 - len(nums))
    try:
        return tuple(int(x) for x in nums[:3])
    except Exception:
        return None


def get_transformers_version():
    try:
        try:
            from importlib.metadata import version, PackageNotFoundError
        except ImportError:
            from importlib_metadata import version, PackageNotFoundError  # type: ignore
        try:
            return version("transformers")
        except PackageNotFoundError:
            return None
    except Exception:
        return None


def candidate_cache_roots():
    roots = []
    env_hf_home = os.environ.get("HF_HOME")
    env_hub_cache = os.environ.get("HUGGINGFACE_HUB_CACHE")
    home = Path.home()

    if env_hub_cache:
        roots.append(Path(env_hub_cache))
    if env_hf_home:
        roots.append(Path(env_hf_home) / "hub")

    roots.extend([
        home / ".cache" / "huggingface" / "hub",
        home / ".cache" / "huggingface",
        Path("/root/.cache/huggingface/hub"),
        Path("/opt/huggingface/hub"),
        Path("/var/cache/huggingface/hub"),
    ])

    # de-duplicate while preserving order
    seen = set()
    out = []
    for r in roots:
        s = str(r)
        if s not in seen:
            seen.add(s)
            out.append(r)
    return out


def scan_for_suspicious_configs():
    hits = []
    scanned_files = 0
    for root in candidate_cache_roots():
        if not root.exists():
            continue
        for path in root.rglob("config.json"):
            try:
                scanned_files += 1
                with path.open("r", encoding="utf-8", errors="ignore") as f:
                    data = json.load(f)
                bad = sorted(SUSPICIOUS_KEYS.intersection(set(data.keys())))
                if bad:
                    hits.append({"path": str(path), "keys": bad})
            except Exception:
                continue
    return scanned_files, hits


def main():
    version_str = get_transformers_version()
    version_tuple = parse_version(version_str) if version_str else None
    scanned_files, hits = scan_for_suspicious_configs()

    print("=== CVE-2026-4372 verification ===")
    print(f"transformers_version={version_str}")
    print(f"scanned_config_files={scanned_files}")
    print(f"suspicious_config_hits={len(hits)}")
    for hit in hits[:20]:
        print(f"hit={hit['path']} keys={','.join(hit['keys'])}")
    if len(hits) > 20:
        print(f"note=truncated_output total_hits={len(hits)}")

    # Decision logic
    if version_tuple is None and scanned_files == 0:
        print("UNKNOWN")
        return 2

    if version_tuple is not None and version_tuple < TARGET_VERSION:
        print("VULNERABLE")
        return 1

    if hits:
        # Even if patched now, suspicious cached artifacts suggest prior exposure risk.
        print("VULNERABLE")
        return 1

    if version_tuple is not None and version_tuple >= TARGET_VERSION:
        print("PATCHED")
        return 0

    print("UNKNOWN")
    return 2


if __name__ == "__main__":
    sys.exit(main())

Sources

1. NVD CVE-2026-4372
2. Patch commit a7f8e7f in huggingface/transformers
3. CVE Record
4. CISA Known Exploited Vulnerabilities Catalog
5. Snyk advisory for transformers
6. Hugging Face transformers releases
7. CSO Online coverage of CVE-2026-4372
8. Hugging Face State of Open Source Spring 2026