CVE-2025-14928

{
  "id": "CVE-2025-14928",
  "sourceIdentifier": "[email protected]",
  "published": "2025-12-23T21:15:48.110",
  "lastModified": "2026-10-19T22:10:00.130",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must convert a malicious checkpoint.\n\nThe specific flaw exists within the convert_config function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-28253."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de inyección de código y ejecución remota de código en convert_config de Hugging Face Transformers HuBERT. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de Hugging Face Transformers. Se requiere interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe convertir un checkpoint malicioso.\\n\\nEl defecto específico existe dentro de la función convert_config. El problema resulta de la falta de validación adecuada de una cadena suministrada por el usuario antes de usarla para ejecutar código Python. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del usuario actual. Fue ZDI-CAN-28253."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Hugging Face",
          "product": "Transformers",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "4.57.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV30": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.0",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-12-26T14:31:22.533381Z",
          "id": "CVE-2025-14928",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:huggingface:transformers:4.57.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "5540780B-B22B-4304-86AB-62CD30684847"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1146/",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}