← signals
2026-07-12·HUGGINGFACE·security risk
meddown

On July 7, 2026, OSV published 12 new CVEs targeting the HuggingFace transformers library (sources 77-88).

On July 7, 2026, OSV published 12 new CVEs targeting the HuggingFace transformers library (sources 77-88).

window 10devidence 88confidence score 100

confidence score

Strong evidence: 3 independent source classes support this read.

100
medium confidence3 independent source classesotherpasses publish gate

signal brief

On July 7, 2026, OSV published 12 new CVEs targeting the HuggingFace transformers library (sources 77-88). The vulnerabilities include multiple Regular Expression Denial of Service (ReDoS) flaws in components such as DonutProcessor, SETTING_RE, MarianTokenizer, and AdamWeightDecay optimizer, as well as a deserialization of untrusted data vulnerability (CVE-2024-3568) and an improper input validation issue allowing username injection. These CVEs affect users of the widely adopted transformers library, potentially enabling denial of service or remote code execution in production AI pipelines.

Subsequently, on July 11, HuggingFace released transformers 5.13.1 on PyPI (source 76), which is assumed to contain patches for these vulnerabilities, though the release notes were not explicit. The rapid release suggests the team is actively addressing the issues, but the breadth of the CVEs (12 in one batch) indicates a systemic security review gap.

What the sources said:

  • OSV advisory 77: "Transformers is vulnerable to ReDoS attack through its DonutProcessor class."
  • OSV advisory 78: "Transformers Deserialization of Untrusted Data vulnerability."
  • OSV advisory 86: "Transformers's Improper Input Validation vulnerability can be exploited through username injection."
  • PyPI release 76: lists transformers 5.13.1 without detailed changelog, but the timing suggests a security fix release.

source data used

Decision support, not stock advice. This signal is research with cited evidence — not a recommendation to buy, sell, or hold any security.