Executive brief
Hugging Face Transformers is a popular machine learning library used to work with pre-trained AI models. A vulnerability in how the library loads model files allows an attacker to execute arbitrary code on a user's system when they open a malicious model file. This could lead to data theft, system compromise, or use of the compromised machine for further attacks. The vulnerability requires the user to manually open a malicious file, but this is a common workflow for data scientists and developers working with ML models.
Technical details
The vulnerability exists in the Hugging Face Transformers library's handling of model files, specifically in the deserialization of Trax models. The library fails to properly validate user-supplied model data before deserializing it, allowing an attacker to craft a malicious model file containing arbitrary Python code. When a user loads the model using the library's standard functions, the untrusted data is deserialized, resulting in arbitrary code execution in the context of the user's Python process. The attack requires user interaction (downloading and opening a malicious model file), but no special privileges. The vulnerability was addressed in version 4.48.0 by removing conversion scripts from release wheels and implementing safer model loading practices.
Affected products
- Hugging Face Transformers >= 0, < 4.48.0
Timeline
- 2024-09-13: disclosed: Vulnerability reported to vendor via bug bounty platform
- 2024-10-14: other: Vendor rejected the vulnerability
- 2024-11-06: other: ZDI notified vendor of intention to publish as 0-day advisory
- 2024-11-19: advisory: Coordinated public release of ZDI advisory ZDI-24-1515
- 2024-11-23: advisory: GitHub Advisory published for CVE-2024-11394
- 2024-12-17: patched: Fix merged in PR #35296; patch available in version 4.48.0