Hugging Face Transformers Library

Platform

Threat entity extracted from intelligence sources

Frequency

3

occurrences

First Seen

June 4, 2026

Last Seen

September 1, 2026

Overview

Recent Events

Relationships

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Related Clusters (3)

Critical RCE Vulnerability Discovered in LLaMA-Factory WebUI

Jul 1·3 sources

Critical RCE Vulnerability in Hugging Face Transformers Library Disclosed

Jun 4·6 sources

Hugging Face Transformers Vulnerability Allows Unauthorized Code Execution

Sep 2·5 sources

Related Articles (3)

VU#456290: Hugging Face Transformers library writes remote code to disk prior to consent check

Cvefeed High Severity Advisories Jun 30, 2026 CVE-2026-58116 - LLaMA-Factory 0.9.5 Remote Code Execution via WebUI Model Path cvefeed.io Open source

cvefeed.io·Jul 1

Hugging Face Transformers contains critical remote code execution vulnerability

Letsdatascience·Jun 4

Related Entities

Zero-day Exploit CVE-2026-58116 CWE-20 - Improper Input Validation Cwe-502 - Deserialization Of Untrusted Data CWE-94 - Code Injection T1059 - Command and Scripting Interpreter T1195 - Supply Chain Compromise T1203 - Exploitation for Client Execution Hugging Face Hub LLaMA-Factory Deserialization Of Untrusted Data LLaMA-Factory Remote Code Execution Via WebUI Model Path