CVE-2025-14929: 
NixOS vulnerability analysis and mitigation

CVE-2025-14929 is a deserialization of untrusted data vulnerability in Hugging Face Transformers, specifically within the X-CLIP checkpoint conversion component. It allows remote attackers to execute arbitrary code on affected installations when a user opens a malicious file or visits a malicious page. The vulnerability was reported to ZDI on December 9, 2025, published as a 0-day advisory on December 18, 2025, and formally assigned a CVE on December 23, 2025. The confirmed affected version is Transformers 5.0.0-rc0, with IBM products bundling the library (watsonx Data Intelligence, Storage Fusion) also listed as affected. It carries a CVSS v3.0 base score of 7.8 (High), assigned by Zero Day Initiative (ZDI Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-502 (Deserialization of Untrusted Data), triggered during the parsing of model checkpoints in the X-CLIP checkpoint conversion workflow. The library fails to properly validate user-supplied data before deserializing it, allowing an attacker to craft a malicious checkpoint file that, when loaded, executes arbitrary code in the context of the running process. The attack vector is local (the malicious file must be opened by the target), requires no privileges, but does require user interaction. The vulnerability was internally tracked as ZDI-CAN-28308 and was initially rejected by a third-party bug bounty program as out of scope before being closed by the vendor as a duplicate, prompting ZDI to publish it as a 0-day (ZDI Advisory).

Successful exploitation grants an attacker arbitrary code execution in the context of the current process, resulting in high confidentiality, integrity, and availability impacts. An attacker could read sensitive data accessible to the process, modify or destroy data, and disrupt service availability. In ML/AI pipeline environments where Transformers is used to load third-party or community-sourced model checkpoints, exploitation could enable supply chain-style attacks or lateral movement within data science infrastructure (ZDI Advisory, Red Hat Bugzilla).

The ZDI advisory was published as a 0-day on December 18, 2025, after the vendor closed the report as a duplicate without issuing a fix, meaning no patch was available at the time of public disclosure. A proof-of-concept is referenced via the ZDI advisory, though full technical exploit details are not publicly released. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.22%, indicating a currently low probability of widespread exploitation (ZDI Advisory, Red Hat Bugzilla).

1. Craft a malicious checkpoint file: Create a specially crafted model checkpoint file (e.g., a .pt or .bin file) that embeds a malicious serialized Python object using tools such as pickle with a custom __reduce__ method that executes arbitrary system commands upon deserialization.
2. Deliver the payload: Host the malicious checkpoint file on a web page, file share, or model repository (e.g., a spoofed Hugging Face Hub repository) and socially engineer the target into downloading and loading it.
3. Trigger checkpoint loading: The target user loads the malicious checkpoint using the Hugging Face Transformers X-CLIP conversion utilities (e.g., via convert_xclip_original_pytorch_to_hf.py or equivalent checkpoint loading code), which invokes the vulnerable deserialization path.
4. Achieve code execution: The deserialized payload executes arbitrary code in the context of the Python process running Transformers, enabling the attacker to establish a reverse shell, exfiltrate data, or perform further actions on the system (ZDI Advisory).

• File System: Unexpected or unfamiliar .pt, .bin, or .pkl checkpoint files in model directories; newly created scripts or executables in directories writable by the Python/ML process.
• Process: Unusual child processes spawned by the Python interpreter (e.g., bash, sh, curl, wget, nc) during or after model loading operations; unexpected network connections initiated by the Python process.
• Network: Outbound connections from ML workstations or servers to unknown external IPs shortly after loading a model checkpoint; DNS queries for unfamiliar domains from data science environments.
• Logs: Python tracebacks or errors related to pickle/deserialization in application logs; unexpected process execution events logged by EDR tools associated with the Python runtime.

ZDI's primary mitigation recommendation is to restrict interaction with the Hugging Face Transformers product, particularly avoiding loading checkpoints from untrusted or unverified sources. Users should only load model checkpoints from trusted, verified repositories and avoid using the X-CLIP checkpoint conversion utilities on files of unknown provenance. IBM has issued advisories for affected bundled products (IBM Storage Fusion, IBM watsonx Data Intelligence) and users of those products should consult the respective IBM support pages for patching guidance. Upgrading to a patched version of the Transformers library when available is the recommended long-term remediation (ZDI Advisory, IBM Advisory 7270923, IBM Advisory 7272658).

The vulnerability was disclosed as a 0-day by ZDI after the vendor closed the report as a duplicate without providing a fix, a disclosure path that drew attention to the handling of security reports in the ML/AI open-source ecosystem. Red Hat tracked the issue in its Bugzilla with high severity, reflecting concern about downstream impact on enterprise Linux distributions that bundle Transformers. IBM subsequently issued formal advisories for its products that bundle the affected library, indicating broader enterprise impact awareness (ZDI Advisory, Red Hat Bugzilla, IBM Advisory 7272658).