Hugging Face Transformers model config injection leading to arbitrary code execution

#!/usr/bin/env python3
"""
verify_cve_2026_4372.py

Checks for vulnerable Hugging Face transformers versions and scans common
Hugging Face cache locations for suspicious internal config fields related to
CVE-2026-4372.

Outputs one of:
  VULNERABLE - vulnerable version present and/or suspicious cached configs found
  PATCHED    - transformers installed at >= 5.3.0 and no suspicious configs found
  UNKNOWN    - transformers not installed, version unreadable, or no readable evidence

Exit codes:
  0 = PATCHED
  1 = VULNERABLE
  2 = UNKNOWN
"""

import json
import os
import re
import sys
from pathlib import Path

TARGET_VERSION = (5, 3, 0)
SUSPICIOUS_KEYS = {"_attn_implementation_internal", "_experts_implementation_internal"}


def parse_version(v):
    nums = re.findall(r"\d+", str(v))
    if len(nums) < 3:
        nums += ["0"] * (3 - len(nums))
    try:
        return tuple(int(x) for x in nums[:3])
    except Exception:
        return None


def get_transformers_version():
    try:
        try:
            from importlib.metadata import version, PackageNotFoundError
        except ImportError:
            from importlib_metadata import version, PackageNotFoundError  # type: ignore
        try:
            return version("transformers")
        except PackageNotFoundError:
            return None
    except Exception:
        return None


def candidate_cache_roots():
    roots = []
    env_hf_home = os.environ.get("HF_HOME")
    env_hub_cache = os.environ.get("HUGGINGFACE_HUB_CACHE")
    home = Path.home()

    if env_hub_cache:
        roots.append(Path(env_hub_cache))
    if env_hf_home:
        roots.append(Path(env_hf_home) / "hub")

    roots.extend([
        home / ".cache" / "huggingface" / "hub",
        home / ".cache" / "huggingface",
        Path("/root/.cache/huggingface/hub"),
        Path("/opt/huggingface/hub"),
        Path("/var/cache/huggingface/hub"),
    ])

    # de-duplicate while preserving order
    seen = set()
    out = []
    for r in roots:
        s = str(r)
        if s not in seen:
            seen.add(s)
            out.append(r)
    return out


def scan_for_suspicious_configs():
    hits = []
    scanned_files = 0
    for root in candidate_cache_roots():
        if not root.exists():
            continue
        for path in root.rglob("config.json"):
            try:
                scanned_files += 1
                with path.open("r", encoding="utf-8", errors="ignore") as f:
                    data = json.load(f)
                bad = sorted(SUSPICIOUS_KEYS.intersection(set(data.keys())))
                if bad:
                    hits.append({"path": str(path), "keys": bad})
            except Exception:
                continue
    return scanned_files, hits


def main():
    version_str = get_transformers_version()
    version_tuple = parse_version(version_str) if version_str else None
    scanned_files, hits = scan_for_suspicious_configs()

    print("=== CVE-2026-4372 verification ===")
    print(f"transformers_version={version_str}")
    print(f"scanned_config_files={scanned_files}")
    print(f"suspicious_config_hits={len(hits)}")
    for hit in hits[:20]:
        print(f"hit={hit['path']} keys={','.join(hit['keys'])}")
    if len(hits) > 20:
        print(f"note=truncated_output total_hits={len(hits)}")

    # Decision logic
    if version_tuple is None and scanned_files == 0:
        print("UNKNOWN")
        return 2

    if version_tuple is not None and version_tuple < TARGET_VERSION:
        print("VULNERABLE")
        return 1

    if hits:
        # Even if patched now, suspicious cached artifacts suggest prior exposure risk.
        print("VULNERABLE")
        return 1

    if version_tuple is not None and version_tuple >= TARGET_VERSION:
        print("PATCHED")
        return 0

    print("UNKNOWN")
    return 2


if __name__ == "__main__":
    sys.exit(main())