Executive brief
The transformers library, a widely-used Python package for machine learning model handling, contains a vulnerability that allows arbitrary code execution through unsafe deserialization of untrusted data. An attacker with limited privileges who tricks a user into loading a malicious model file can execute arbitrary code with the user's permissions, potentially compromising AI/ML pipelines and sensitive data.
Technical details
The vulnerability (CWE-502) involves unsafe use of pickle.load() on untrusted model files without proper validation. The vulnerable code deserializes pickle-formatted model artifacts from remote sources or user-supplied files without requiring explicit trust declarations. An attacker can craft a malicious pickle file that executes arbitrary Python code during deserialization. The fix restricts pickle.load() to require the TRUST_REMOTE_CODE environment variable be set to True, forcing developers to explicitly opt-in to loading untrusted models. The vulnerability affects all versions prior to 4.36.0, and requires low privileges and user interaction (loading a remote model).
Affected products
- Hugging Face transformers 0 to 4.35.2
Timeline
- 2023-12-19: disclosed
- 2023-12-04: patched: Fix committed; version 4.36.0 released with patch