{"id":"CVE-2026-1839","aliases":["GHSA-69w3-r845-3855","PYSEC-2026-2288"],"url":"https://o3.security/vulnerability/CVE-2026-1839","summary":"Arbitrary Code Execution via Unsafe torch.load() in Trainer Checkpoint Loading in huggingface/transformers","details":"A vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. The `_load_rng_state()` method in `src/transformers/trainer.py` at line 3059 calls `torch.load()` without the `weights_only=True` parameter. This issue affects all versions of the library supporting `torch>=2.2` when used with PyTorch versions below 2.6, as the `safe_globals()` context manager provides no protection in these versions. An attacker can exploit this vulnerability by supplying a malicious checkpoint file, such as `rng_state.pth`, which can execute arbitrary code when loaded. The issue is resolved in version v5.0.0rc3.","published":"2026-04-07T05:22:00.959Z","modified":"2026-08-07T11:49:50.854528998Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"transformers","fixedVersion":"5.0.0rc3"}],"fix":{"url":"https://github.com/huggingface/transformers/commit/03c8082ba4594c9b8d6fe190ca9bed0e5f8ca396","label":"huggingface/transformers@03c8082"},"references":[{"type":"WEB","url":"https://huntr.com/bounties/3c77bb97-e493-493d-9a88-c57f5c536485"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1839.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1839"},{"type":"FIX","url":"https://github.com/huggingface/transformers/commit/03c8082ba4594c9b8d6fe190ca9bed0e5f8ca396"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T11:49:50.854528998Z"}}