CVE-2025-14926: 
NixOS vulnerability analysis and mitigation

CVE-2025-14926 is a code injection vulnerability in Hugging Face Transformers affecting the SEW (Speech Encoder-Decoder with Wav2Vec2) model's convert_config function, enabling remote code execution when a user converts a malicious checkpoint. It was reported to the vendor on October 14, 2025, rejected by Hugging Face on November 12, 2025, and publicly disclosed as a 0-day advisory by the Zero Day Initiative (ZDI) on December 18, 2025. The vulnerability is confirmed to affect Hugging Face Transformers version 4.57.0, and IBM Storage Fusion (which bundles Transformers) is also listed as an affected product. It carries a CVSS v3.0 base score of 7.8 (High), assigned by ZDI (ZDI Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-94 (Improper Control of Generation of Code / Code Injection): the convert_config function in the SEW model conversion pipeline fails to properly validate a user-supplied string before passing it to Python code execution (ZDI Advisory). The attack vector is local (AV:L), meaning the attacker must supply a maliciously crafted checkpoint file that the victim then processes using the Transformers library — for example, by hosting a poisoned model checkpoint on a public repository such as Hugging Face Hub. No privileges are required on the part of the attacker, but user interaction is necessary (the victim must initiate the checkpoint conversion). The vulnerability was tracked internally as ZDI-CAN-28251 and was discovered by Peter Girnus (@gothburz) and Brandon Niemczyk of Trend Micro's Zero Day Initiative (ZDI Advisory).

Successful exploitation allows an attacker to execute arbitrary Python code in the context of the user running the Transformers library, resulting in high confidentiality, integrity, and availability impact. Depending on the privileges of the affected user, this could lead to full system compromise, unauthorized access to sensitive data (e.g., model weights, API keys, training data), or installation of persistent malware. In ML/AI pipeline environments where checkpoint conversion is automated or performed with elevated privileges, the blast radius could extend to broader infrastructure compromise (ZDI Advisory, IBM Advisory).

A ZDI advisory (ZDI-25-1147) serves as a public proof-of-concept reference, published on December 18, 2025, after Hugging Face rejected the vulnerability report (ZDI Advisory). There is no confirmed evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.072% (0.000720), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The social engineering aspect — tricking a user into converting a malicious checkpoint — is a realistic attack scenario given the widespread practice of downloading and converting community-shared model checkpoints.

1. Craft a malicious checkpoint: Create a SEW model checkpoint (e.g., a config.json or associated configuration file) that embeds a malicious user-supplied string in a field processed by the convert_config function, designed to inject arbitrary Python code when evaluated.
2. Host the malicious checkpoint: Upload the crafted checkpoint to a publicly accessible location such as Hugging Face Hub, a GitHub repository, or a file-sharing service, potentially impersonating a legitimate model to increase the likelihood of victim interaction.
3. Social engineering: Lure the target into downloading and converting the malicious checkpoint — for example, by advertising it as a useful pre-trained SEW model, referencing it in forums, or submitting it to model aggregators.
4. Trigger exploitation: When the victim runs a conversion command (e.g., using convert_wav2vec2_original_pytorch_checkpoint_to_pytorch.py or similar Transformers conversion scripts) against the malicious checkpoint, the convert_config function processes the injected string without validation.
5. Achieve code execution: The injected Python code executes in the context of the current user, enabling actions such as spawning a reverse shell, exfiltrating credentials or data, or establishing persistence on the victim's system (ZDI Advisory).

• File System: Unexpected or unfamiliar checkpoint files (e.g., config.json, .bin, .pt files) downloaded from unverified sources; new scripts or executables created in the working directory or user home directory following a checkpoint conversion.
• Process: Unusual child processes spawned by the Python interpreter during or after a Transformers checkpoint conversion (e.g., bash, sh, curl, wget, nc, python -c); unexpected network connections initiated by the Python process.
• Network: Outbound connections to unknown external IPs or domains from the machine running Transformers immediately following a checkpoint conversion operation.
• Logs: Python tracebacks or unusual output in conversion script logs referencing convert_config; system logs showing new user accounts, cron jobs, or scheduled tasks created around the time of checkpoint conversion.

Hugging Face rejected the vulnerability report, and no official patch from Hugging Face was available at the time of ZDI's disclosure; ZDI's recommended mitigation is to restrict interaction with the product (ZDI Advisory). A patch reference has been added via Red Hat Bugzilla (Bug ID 2424723), and IBM has issued an advisory for affected IBM Fusion/Storage Fusion products (IBM Advisory, Red Hat Bugzilla). Actionable steps include: (1) only convert checkpoints from fully trusted and verified sources; (2) run checkpoint conversion in isolated, sandboxed environments (e.g., containers with no network access and minimal privileges); (3) review and audit any automated pipelines that perform checkpoint conversion; (4) monitor for updated patches from Hugging Face and apply them promptly when available.

Hugging Face rejected the vulnerability report submitted through a third-party bug bounty program on November 12, 2025, prompting ZDI to publish the advisory as a 0-day on December 18, 2025 — a notable instance of a major AI/ML vendor declining to address a reported RCE (ZDI Advisory). Red Hat tracked the issue via Bugzilla and IBM issued a downstream advisory for affected products, indicating concern from enterprise vendors who bundle Transformers (Red Hat Bugzilla, IBM Advisory). The disclosure highlights ongoing security risks in the AI/ML supply chain, particularly around the practice of downloading and converting community-shared model checkpoints from public repositories.