CVE-2025-14928: 
NixOS vulnerability analysis and mitigation

CVE-2025-14928 is a code injection vulnerability in Hugging Face Transformers affecting the HuBERT model conversion workflow, specifically the convert_config function. It allows remote attackers to execute arbitrary code on affected installations when a user converts a maliciously crafted checkpoint. The vulnerability was reported to the vendor on October 14, 2025; after the vendor rejected the report on November 12, 2025, ZDI published it as a 0-day advisory on December 18, 2025, with NVD publication on December 23, 2025. The confirmed affected version is Transformers 4.57.0, and downstream products including IBM Storage Fusion and IBM watsonx Data Intelligence are also impacted. The CVSS v3.0 base score is 7.8 (High), assigned by Zero Day Initiative (ZDI Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). The flaw resides in the convert_config function within the HuBERT model conversion pipeline, where a user-supplied string is passed to a Python code execution context without adequate sanitization or validation. An attacker crafts a malicious model checkpoint that, when processed by a victim using the Transformers library's conversion utility, triggers the injection of arbitrary Python code. Exploitation requires local access in the sense that the victim must actively invoke the checkpoint conversion (user interaction required), but the attack can be initiated remotely by distributing a poisoned checkpoint file (ZDI Advisory).

Successful exploitation allows an attacker to execute arbitrary code in the security context of the current user running the Transformers library. This results in high confidentiality, integrity, and availability impact — an attacker could access sensitive data on the system, modify or destroy files, and disrupt service. In environments where Transformers is used as part of larger ML pipelines (e.g., IBM Fusion or IBM watsonx Data Intelligence), exploitation could enable lateral movement within the network or compromise of downstream systems (ZDI Advisory, IBM Advisory).

ZDI published this as a 0-day advisory on December 18, 2025, after Hugging Face rejected the vulnerability report. A proof-of-concept exploit reference is available via the ZDI advisory (ZDI-CAN-28253), though no evidence of active in-the-wild exploitation has been observed as of the time of reporting. The EPSS score is approximately 0.072% (0.000720), indicating a currently low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been made (ZDI Advisory, Red Hat Bugzilla).

1. Craft a malicious checkpoint: An attacker creates a HuBERT model checkpoint file that embeds a malicious payload in a configuration field processed by the convert_config function — specifically a string that will be evaluated as Python code without sanitization.
2. Distribute the checkpoint: The attacker distributes the malicious checkpoint via a public model repository (e.g., Hugging Face Hub), a phishing link, or a supply chain compromise, targeting users or automated pipelines that perform checkpoint conversion.
3. Trigger victim interaction: The victim downloads and invokes the Transformers library's HuBERT conversion utility (e.g., convert_hubert_original_pytorch_checkpoint_to_pytorch.py or equivalent), passing the malicious checkpoint as input.
4. Code injection executes: The convert_config function processes the attacker-controlled string and passes it to a Python eval() or exec()-equivalent call without validation, executing the embedded payload in the context of the current user.
5. Achieve objective: The injected code runs with the victim's privileges, enabling reverse shell establishment, credential theft, data exfiltration, or further lateral movement within the environment (ZDI Advisory).

• File System: Unexpected or newly downloaded HuBERT checkpoint files (.bin, .pt, .ckpt) from untrusted or unverified sources; presence of unusual scripts or executables created in directories writable by the user running Transformers.
• Process: Unexpected child processes spawned by the Python interpreter running the Transformers conversion script (e.g., bash, sh, curl, wget, nc, python3 -c); unusual network connections initiated by the Python process.
• Network: Outbound connections to unknown external IPs or domains from the host running the Transformers library, particularly shortly after a checkpoint conversion operation.
• Logs: Python runtime errors or tracebacks in application logs related to convert_config with unusual string inputs; OS-level audit logs showing unexpected command execution by the user account running the conversion job.

A patch has been tracked via Red Hat Bugzilla (ID: 2424731), and IBM has issued advisories for affected products (IBM Storage Fusion and IBM watsonx Data Intelligence). Users should update to a patched version of Hugging Face Transformers as soon as one is available from their distribution or vendor. As a workaround, ZDI recommends restricting interaction with the product — specifically, users should only convert checkpoints from fully trusted and verified sources, and avoid processing model files from unknown or unvetted repositories. Organizations using IBM products bundling Transformers should apply the relevant IBM security updates (Red Hat Bugzilla, IBM Advisory, ZDI Advisory).

The vulnerability was disclosed as a 0-day by ZDI after Hugging Face rejected the original bug report submitted through a third-party bug bounty program, a disclosure path that drew attention to the vendor's handling of the report. Red Hat tracked the issue via its security response process (Bugzilla ID 2424731) and IBM issued downstream advisories for affected products. No significant public researcher commentary or social media discussion beyond standard vulnerability tracking aggregators has been identified.