CVE-2025-14927: 
NixOS vulnerability analysis and mitigation

CVE-2025-14927 is a code injection vulnerability in Hugging Face Transformers, specifically within the SEW-D model's convert_config function, that allows remote attackers to execute arbitrary code. The flaw was reported to the vendor on October 14, 2025; after the vendor rejected the report on November 12, 2025, Zero Day Initiative (ZDI) published it as a 0-day advisory on December 18, 2025, with NVD publication on December 23, 2025. The vulnerability affects Hugging Face Transformers version 4.57.0 and is also tracked as GHSA-jpvf-f2r6-62cq. It carries a CVSS v3.0 base score of 7.8 (High), assigned by ZDI (ZDI Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). The root cause lies in the convert_config function within the SEW-D model conversion pipeline, which fails to properly validate user-supplied strings before passing them to Python code execution routines. An attacker can craft a malicious model checkpoint that, when a victim converts it using the affected function, triggers arbitrary Python code execution in the context of the current user. The attack vector is local (the malicious checkpoint must be processed by the target), requires no privileges, but does require user interaction — specifically, the victim must initiate the checkpoint conversion (ZDI Advisory, Red Hat Bugzilla).

Successful exploitation grants an attacker arbitrary code execution in the context of the current user, resulting in high confidentiality, integrity, and availability impact. An attacker could exfiltrate sensitive data accessible to the user, modify or destroy files, or use the compromised environment as a pivot point for further lateral movement within a network. In ML/AI pipeline environments where model checkpoints are routinely shared and converted, the blast radius could extend to training infrastructure, model repositories, or downstream systems (ZDI Advisory, IBM Advisory).

A proof-of-concept exploit reference is available via the ZDI advisory (ZDI-25-1148), published as a 0-day on December 18, 2025, after Hugging Face rejected the vulnerability report. There is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.072% (0.000720), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (ZDI Advisory).

1. Craft a malicious checkpoint: An attacker creates a SEW-D model checkpoint file that embeds a malicious string payload within the configuration data processed by the convert_config function — designed to be interpreted as executable Python code.
2. Distribute the checkpoint: The attacker distributes the malicious checkpoint via a public model hub (e.g., Hugging Face Hub), a shared file system, a phishing email, or a supply chain compromise targeting ML practitioners.
3. Induce victim interaction: The attacker tricks or waits for a target user to download and attempt to convert the malicious checkpoint using the Hugging Face Transformers library (e.g., via a conversion script or API call that invokes convert_config).
4. Trigger code injection: When the victim's environment processes the checkpoint, the convert_config function passes the attacker-controlled string to a Python code execution routine without proper validation, executing the embedded payload.
5. Achieve code execution: The injected code runs in the context of the current user, enabling actions such as spawning a reverse shell, exfiltrating credentials or model data, or establishing persistence on the victim's system (ZDI Advisory).

• File System: Unexpected or newly downloaded SEW-D model checkpoint files (e.g., .bin, .pt, .safetensors) from untrusted or unverified sources; suspicious configuration files associated with SEW-D model directories.
• Process: Unusual child processes spawned by Python interpreter during model conversion (e.g., bash, sh, curl, wget, nc, python -c); unexpected network connections initiated by a Python process running Transformers.
• Network: Outbound connections to unknown or suspicious IP addresses/domains originating from a Python/ML environment immediately following a checkpoint conversion operation.
• Logs: Python tracebacks or unusual output during convert_config execution; unexpected file writes or permission changes in the working directory during model conversion.

ZDI's advisory states that the only salient mitigation is to restrict interaction with the affected product, as no vendor patch was issued in response to the disclosure. A patch reference was documented in Red Hat Bugzilla (Bug ID: 2424751) as of December 24, 2025, and IBM has issued an advisory for affected bundled products (IBM Fusion, IBM Fusion HCI, Content-Aware Storage). Users should: (1) avoid converting SEW-D model checkpoints from untrusted or unverified sources; (2) update to the latest available version of Hugging Face Transformers; (3) implement strict input validation and sandboxing for checkpoint conversion workflows; and (4) apply the principle of least privilege when running model conversion tools (ZDI Advisory, Red Hat Bugzilla, IBM Advisory).

The vulnerability was published as a 0-day by ZDI after Hugging Face rejected the original bug report submitted through a third-party bug bounty program, a disclosure outcome that drew attention to the vendor's handling of the report. ZDI credited researchers Peter Girnus (@gothburz) and Brandon Niemczyk of Trend Micro's Zero Day Initiative for the discovery. No significant public statements from Hugging Face or broad social media discussion have been documented beyond the ZDI advisory and downstream aggregator coverage (ZDI Advisory).