CVE-2025-14920: 
NixOS vulnerability analysis and mitigation

CVE-2025-14920 is a deserialization of untrusted data vulnerability in Hugging Face Transformers, specifically within the Perceiver model file parsing logic, that allows remote attackers to execute arbitrary code. The vulnerability was reported to the vendor on October 16, 2024, closed as a duplicate on October 17, 2024, and ultimately published as a 0-day advisory by Zero Day Initiative (ZDI) on December 18, 2025, after the vendor failed to provide fix details. The affected product is Hugging Face Transformers version 4.54.1; IBM Storage Fusion (which bundles Transformers) is also affected. It carries a CVSS v3.0 base score of 7.8 (High), assigned by ZDI (ZDI Advisory, Red Hat Bugzilla).

The root cause is improper validation of user-supplied data during the parsing of Perceiver model files in Hugging Face Transformers, classified as CWE-502 (Deserialization of Untrusted Data) and mapped to CAPEC-586 (Object Injection). An attacker crafts a malicious model file that, when loaded by the Transformers library, triggers unsafe deserialization and executes arbitrary code in the context of the current user. Exploitation requires user interaction — the victim must open a malicious file or visit a malicious page that causes the model file to be loaded. The vulnerability was internally tracked as ZDI-CAN-25423 and credited to researcher "The_Kernel_Panic" (ZDI Advisory).

Successful exploitation grants an attacker arbitrary code execution in the context of the user running the Transformers library, resulting in high impact to confidentiality, integrity, and availability. An attacker could exfiltrate sensitive data, modify or destroy files, install persistent malware, or use the compromised environment as a pivot point for lateral movement within ML infrastructure or data pipelines. Environments where Transformers is used to load externally sourced or user-provided model files are at greatest risk (ZDI Advisory, IBM Advisory).

The ZDI published this as a 0-day advisory on December 18, 2025, after the vendor did not provide a patch, meaning no official fix was available at the time of public disclosure. No evidence of in-the-wild exploitation or threat actor attribution has been reported. The EPSS score is approximately 0.0022 (0.22%), indicating a currently low probability of active exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack vector is local and requires user interaction, which limits opportunistic exploitation (ZDI Advisory).

1. Craft malicious model file: Create a specially crafted Perceiver model file (e.g., a pickle-based or otherwise serialized model artifact) that embeds a malicious payload designed to execute arbitrary code upon deserialization.
2. Deliver the file: Distribute the malicious model file via a phishing email, a compromised model repository (e.g., a fake or hijacked Hugging Face Hub repository), a malicious web page, or a supply chain attack targeting ML pipelines.
3. Induce victim to load the file: Trick the target user or automated pipeline into loading the malicious model file using the Hugging Face Transformers library (e.g., via from_pretrained() or similar model loading APIs).
4. Trigger deserialization: When Transformers parses the model file, the lack of input validation causes the malicious serialized object to be deserialized, executing the embedded payload in the context of the current user.
5. Achieve code execution: The attacker's payload runs with the privileges of the user or service account running the Transformers process, enabling reverse shell establishment, data exfiltration, or further system compromise (ZDI Advisory).

• File System: Unexpected or unfamiliar model files (e.g., .pkl, .bin, .pt) loaded from untrusted or external sources; new files created in the user's home directory or temp directories by the Python process.
• Process: Unusual child processes spawned by the Python interpreter running Transformers (e.g., bash, sh, curl, wget, nc); unexpected network connections initiated by Python processes.
• Network: Outbound connections to unknown or suspicious IP addresses or domains originating from the ML workstation or server shortly after model loading.
• Logs: Python runtime errors or tracebacks related to deserialization (e.g., pickle-related exceptions) in application logs; unexpected execution of system commands logged by endpoint detection tools.

As of the 0-day disclosure date (December 18, 2025), no official patch from Hugging Face was available; ZDI's only recommended mitigation is to restrict interaction with the affected product. Users should avoid loading model files from untrusted or unverified sources, and prefer safe serialization formats (e.g., safetensors) over pickle-based formats when possible. IBM has released an advisory for affected IBM Storage Fusion and IBM Fusion HCI products bundling Transformers, and users of those products should consult the IBM advisory for specific remediation guidance (ZDI Advisory, IBM Advisory).

The ZDI published the advisory as a 0-day after the vendor initially closed the report as a duplicate and subsequently failed to provide fix details over more than a year, highlighting concerns about vendor responsiveness in the ML/AI ecosystem. Red Hat opened a high-severity bug tracker entry (Bug 2424755) and engaged a broad set of product security personnel, indicating downstream concern across Linux distributions and enterprise products. No significant public social media debate or notable researcher commentary beyond the ZDI disclosure has been identified (ZDI Advisory, Red Hat Bugzilla).