# CVE-2023-6730: PYSEC-2023-300 - Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.

Source: https://junglewise.ai/threats/cve-2023-6730-hugging-face-transformers-deserialization-of-untrusted-data  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-12-19. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2023-6730 · Severity: low · CVSS 3.1 · Published 2023-12-19

The transformers library, a widely-used Python package for machine learning model handling, contains a vulnerability that allows arbitrary code execution through unsafe deserialization of untrusted data. An attacker with limited privileges who tricks a user into loading a malicious model file can execute arbitrary code with the user's permissions, potentially compromising AI/ML pipelines and sensitive data.

Technologies: [Hugging Face Transformers](https://junglewise.ai/threats/technologies/transformers), [transformers (PyPI)](https://junglewise.ai/threats/technologies/pypi-transformers). Vendors: [Hugging Face](https://junglewise.ai/threats/vendors/hugging-face), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2023-6730 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-6730 being exploited in the wild.

**How severe is CVE-2023-6730?** Low severity, with a CVSS score of 3.1, published 19 December 2023.

**Which products and versions are affected?** Hugging Face Transformers 0 to 4.35.2; transformers (PyPI) GIT:introduced=0,fixed=1d63b0ec361e7a38f1339385e8a5a855085532ce|ECOSYSTEM:introduced=0,fixed=4.36.0.

**Is there a fix for CVE-2023-6730?** Yes. transformers (PyPI): upgrade to 4.36.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-6730 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2023-6730?** Check whether you run Hugging Face Transformers or transformers (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- transformers (PyPI): upgrade to 4.36.0 or later

  ```sh
  pip install "transformers>=4.36.0"
  ```


## Technical details

The vulnerability (CWE-502) involves unsafe use of pickle.load() on untrusted model files without proper validation. The vulnerable code deserializes pickle-formatted model artifacts from remote sources or user-supplied files without requiring explicit trust declarations. An attacker can craft a malicious pickle file that executes arbitrary Python code during deserialization. The fix restricts pickle.load() to require the TRUST_REMOTE_CODE environment variable be set to True, forcing developers to explicitly opt-in to loading untrusted models. The vulnerability affects all versions prior to 4.36.0, and requires low privileges and user interaction (loading a remote model).

## Affected products

- Hugging Face transformers 0 to 4.35.2

## Identifiers

- CVE-2023-6730
- GHSA-3863-2447-669p
- PYSEC-2023-300

## Timeline

- 2023-12-19: disclosed
- 2023-12-04: patched: Fix committed; version 4.36.0 released with patch

## References

- [https://github.com/huggingface/transformers/commit/1d63b0ec361e7a38f1339385e8a5a855085532ce](https://github.com/huggingface/transformers/commit/1d63b0ec361e7a38f1339385e8a5a855085532ce)

## Related threats

- [Hugging Face Transformers arbitrary file write via load_custom_generate](https://junglewise.ai/threats/cve-2026-80047-hugging-face-transformers-arbitrary-file-write-via-load-custom)
- [Hugging Face Transformers path traversal in save_pretrained](https://junglewise.ai/threats/cve-2026-9856-hugging-face-transformers-path-traversal-in-save-pretrained)
- [Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer](https://junglewise.ai/threats/cve-2025-6921-hugging-face-transformers-vulnerable-to-regular-expression-denial)
- [PYSEC-2026-1988 - Hugging Face Transformers library has Regular Expression Denial of Service](https://junglewise.ai/threats/cve-2025-6051-hugging-face-transformers-library-has-regular-expression-denial-of)
- [PYSEC-2026-1981 - Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer](https://junglewise.ai/threats/cve-2025-6638-hugging-face-transformers-is-vulnerable-to-redos-through-its)