CVE-2025-14930: 
NixOS vulnerability analysis and mitigation

CVE-2025-14930 is a deserialization of untrusted data vulnerability in Hugging Face Transformers, specifically within the GLM4 model weight parsing logic, that allows remote attackers to execute arbitrary code. The flaw was reported to ZDI on December 9, 2025, and publicly disclosed as a 0-day advisory on December 18, 2025, after the vendor closed the case as a duplicate and the bug bounty program rejected it as out of scope. The vulnerability affects Hugging Face Transformers version 4.57.1, and downstream products including IBM Storage Fusion and IBM watsonx Data Intelligence that bundle the library. It carries a CVSS v3.0 base score of 7.8 (High), assigned by Zero Day Initiative (ZDI Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-502 (Deserialization of Untrusted Data), triggered during the parsing of model weight files in the GLM4 component of the Hugging Face Transformers library. The library fails to properly validate user-supplied data before deserializing it, allowing an attacker to craft a malicious model file or page that, when loaded by a victim, causes arbitrary code execution in the context of the running process. The attack vector is local (the malicious file must be opened or a malicious page visited), requires no privileges, but does require user interaction — making social engineering a likely delivery mechanism. The vulnerability was tracked internally as ZDI-CAN-28309 and is also aliased as GHSA-9qm5-hqg9-j2fx (ZDI Advisory, Red Hat Bugzilla).

Successful exploitation grants an attacker arbitrary code execution within the context of the process loading the malicious model file, resulting in high confidentiality, integrity, and availability impact. An attacker could achieve full compromise of the affected system, enabling unauthorized data access, data theft, installation of malware, or further lateral movement within the environment. Organizations using Hugging Face Transformers for AI/ML workloads — including those running IBM Storage Fusion or IBM watsonx Data Intelligence — are at risk of having their model-serving infrastructure compromised (ZDI Advisory, IBM Advisory).

A proof-of-concept advisory was published by Zero Day Initiative on December 18, 2025, but no evidence of active in-the-wild exploitation has been reported as of the time of this report. The EPSS score is approximately 0.22%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was discovered and credited to Peter Girnus (@gothburz), Demeng Chen, and Brandon Niemczyk of Trend Zero Day Initiative (ZDI Advisory).

1. Craft a malicious GLM4 model file: Create a specially crafted model weight file (e.g., a .bin or serialized checkpoint) that embeds a malicious deserialization payload targeting the GLM4 weight parsing logic in Hugging Face Transformers.
2. Deliver the payload: Distribute the malicious file via a phishing email, a compromised model repository (e.g., a fake or hijacked Hugging Face Hub model), or a malicious web page that triggers automatic model loading.
3. Induce user interaction: Trick the target user or automated pipeline into loading the malicious model file using the Transformers library (e.g., via AutoModel.from_pretrained() or a similar API call that triggers weight deserialization).
4. Trigger deserialization: When the Transformers library parses the malicious weight file, the lack of input validation causes the embedded payload to be deserialized and executed.
5. Achieve code execution: Arbitrary code runs in the context of the process (e.g., a Python ML training or inference process), potentially granting the attacker a reverse shell, credential access, or persistent foothold on the system (ZDI Advisory).

• File System: Unexpected or unfamiliar model weight files (.bin, .pt, .pkl) downloaded from untrusted or unverified sources; presence of serialized Python objects (e.g., pickle-based payloads) within model directories.
• Process: Unusual child processes spawned by a Python ML process (e.g., bash, sh, curl, wget, python -c) that are not part of normal model loading workflows; unexpected network connections initiated by the Transformers process.
• Network: Outbound connections to unknown or suspicious IP addresses or domains from ML inference or training servers shortly after model loading; DNS queries for unfamiliar domains from AI/ML workload hosts.
• Logs: Python tracebacks or errors related to deserialization or pickle loading in application logs; unexpected exec, subprocess, or os.system calls logged in Python audit logs or security monitoring tools.

ZDI's primary recommended mitigation is to restrict interaction with the Hugging Face Transformers library and avoid loading model files from untrusted or unverified sources. A patch reference has been filed via Red Hat Bugzilla (Bug ID: 2424769), and IBM has issued advisories for affected downstream products (IBM Storage Fusion and IBM watsonx Data Intelligence). Users should update to a patched version of Hugging Face Transformers as soon as one is available, implement strict input validation for model files, use network segmentation to limit exposure of ML workloads, and monitor for suspicious process behavior during model loading (ZDI Advisory, Red Hat Bugzilla, IBM Advisory).

The vulnerability was disclosed as a 0-day by ZDI after the vendor closed the report as a duplicate and the bug bounty program rejected it as out of scope, which drew attention to the disclosure process. IBM subsequently issued advisories acknowledging the impact on its Storage Fusion and watsonx Data Intelligence products that bundle the affected Transformers library. Community aggregators including Vulners, CIRCL Vulnerability Lookup, and security news outlets such as Let's Data Science covered the disclosure, reflecting moderate industry interest given the widespread use of Hugging Face Transformers in AI/ML pipelines (ZDI Advisory, IBM Advisory).