fix(deps): update dependency transformers to v5 [security] - #348
Open
dreadnode-renovate-bot[bot] wants to merge 1 commit into
Open
fix(deps): update dependency transformers to v5 [security]#348dreadnode-renovate-bot[bot] wants to merge 1 commit into
dreadnode-renovate-bot[bot] wants to merge 1 commit into
Conversation
dreadnode-renovate-bot
Bot
added
area/python
dreadnode-renovate-bot
Bot
force-pushed
the
renovate/pypi-transformers-vulnerability
branch
from
July 5, 2026 00:40
ac6e990 to
7cf1789
Compare
dreadnode-renovate-bot
Bot
force-pushed
the
renovate/pypi-transformers-vulnerability
branch
from
July 15, 2026 00:28
7cf1789 to
74b5f3d
Compare
| datasource | package | from | to | | ---------- | ------------ | ------ | ------ | | pypi | transformers | 4.57.1 | 5.10.1 |
dreadnode-renovate-bot
Bot
force-pushed
the
renovate/pypi-transformers-vulnerability
branch
from
September 6, 2026 00:30
74b5f3d to
882e4d1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
>=4.41.0,<5.0.0→>=5.10.1,<5.11.0HuggingFace Transformers allows for arbitrary code execution in the
TrainerclassCVE-2026-1839 / GHSA-69w3-r845-3855
More information
Details
A vulnerability in the HuggingFace Transformers library, specifically in the
Trainerclass, allows for arbitrary code execution. The_load_rng_state()method insrc/transformers/trainer.pyat line 3059 callstorch.load()without theweights_only=Trueparameter. This issue affects all versions of the library supportingtorch>=2.2when used with PyTorch versions below 2.6, as thesafe_globals()context manager provides no protection in these versions. An attacker can exploit this vulnerability by supplying a malicious checkpoint file, such asrng_state.pth, which can execute arbitrary code when loaded. The issue is resolved in version v5.0.0rc3.Severity
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
HuggingFace transformers vulnerable to remote code execution
CVE-2026-4372 / GHSA-29pf-2h5f-8g72
More information
Details
A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious
config.jsonfile containing the_attn_implementation_internalfield set to an attacker-controlled HuggingFace Hub repository ID. When a victim loads this model using the standardAutoModelForCausalLM.from_pretrained()API, the library downloads and executes arbitrary Python code from the attacker's repository with the victim's full OS privileges. This issue arises due to unfiltered deserialization of configuration attributes, insufficient sanitization of internal fields, and unsandboxed execution of downloaded kernels. The vulnerability bypasses thetrust_remote_codesecurity mechanism, is invisible to the victim, and exploits the standard documented usage pattern, making it particularly severe. Users are advised to upgrade to version 5.3.0 or later to mitigate this issue.Severity
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path
CVE-2026-5241 / GHSA-fgcw-684q-jj6r
More information
Details
A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the
trust_remote_codeparameter, intended to prevent remote code execution, is overridden by untrusted serialized configuration data in a nested code path. Specifically, when loading a LightGlue model usingAutoModel.from_pretrained()withtrust_remote_code=False, theLightGlueConfigreads thetrust_remote_codevalue from the untrustedconfig.jsonfile and propagates it into nestedAutoConfig.from_pretrained()calls. This results in the execution of attacker-provided Python modules, even when the victim explicitly disables remote code execution. The vulnerability poses a high risk for environments such as API inference servers, research notebooks, CI/CD pipelines, and model evaluation workers, potentially leading to credential theft, lateral movement, or persistence/backdoor deployment.Severity
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Transformers save_pretrained path traversal allows arbitrary file writes through chat template names
CVE-2026-9856 / GHSA-xrqw-3rrv-vx5w
More information
Details
A vulnerability in huggingface/transformers versions < 5.10.0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the
save_pretrained()methods ofPreTrainedTokenizerBaseandProcessorMixin, where keys from thechat_templatedictionary are used directly as filenames without proper validation. An attacker can exploit this by publishing a malicious Hugging Face Hub repository with a craftedtokenizer_config.jsonfile. When a victim downloads and saves the tokenizer or processor, the attacker-controlled keys can escape the intended save directory, enabling arbitrary file writes with attacker-controlled content. This vulnerability affects multiple processors inheriting fromProcessorMixin, including Idefics, Florence, Gemma, Phi, and Qwen-VL.Severity
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
huggingface/transformers (transformers)
v5.10.1Compare Source
Release v5.10.1
v5.10.0 was yanked as we publish on a corrupted branch. Sorry everyone, this happens when we rush a release!!!
New Model additions
Gemma4 unified+ Gemma4 MTP
Gemma 4 12B Unified is an encoder-free multimodal model with pretrained and instruction-tuned variants. Unlike standard Gemma 4, which uses dedicated encoder towers, Gemma 4 12B Unified projects raw inputs directly into the language model's embedding space through lightweight linear pipelines. This results in a simpler architecture while maintaining strong multimodal performance.
Key differences from standard Gemma 4:
Dense + LayerNormpipeline with factorized 2D positional embeddings, replacing the vision encoder.RMSNorm → Linearpipeline, replacing the mel spectrogram + Conformer encoder.Gemma4UnifiedMultimodalEmbedder(RMSNorm → Linear) for the final projection to text hidden space.You can find the original Gemma 4 12B Unified checkpoints under the Gemma 4 release.
Sapiens2
Sapiens2 is a family of high-resolution vision transformers pretrained on ~1 billion curated human images, designed for human-centric computer vision tasks including pose estimation, body-part segmentation, surface normal estimation, and pointmap estimation. The models scale from 0.4B to 5B parameters and train at native 1K resolution, with hierarchical 4K variants for extended spatial reasoning. Sapiens2 achieves substantial improvements over its predecessor with +4 mAP in pose estimation, +24.3 mIoU in body-part segmentation, and 45.6% error reduction in normal estimation.
Links: Documentation | Paper
DeepSeek-OCR-2
DeepSeek-OCR-2 is an OCR-specialized vision-language model built on a distinctive architecture that combines a SAM ViT-B vision encoder with a Qwen2 hybrid attention encoder, connected through an MLP projector to a DeepSeek-V2 Mixture-of-Experts (MoE) language model. The model features a hybrid attention mechanism that applies bidirectional attention over image tokens and causal attention over query tokens, enabling efficient and accurate document understanding. It supports both plain OCR tasks and grounding capabilities with coordinate-aware output for document conversion to markdown format.
Links: Documentation
Mellum
Mellum is a code-focused Mixture-of-Experts language model developed by JetBrains. It is derived from the Qwen3-MoE architecture with per-layer-type RoPE and interleaved sliding window attention. The model has 12B total parameters with 2.5B active parameters per token, using 64 routed experts with 8 activated per token across 28 layers.
Links: Documentation
Mellumv2 code generation model (#46112) by @shadeMe in #46112Breaking changes
The Gemma4 vision pooler now casts inputs to float32 before scaling to prevent float16 overflow (inf saturation) with large checkpoints, which may cause minor numerical differences in outputs for users running Gemma-4 vision models in float16.
Audio Language Models (ALMs) now have a dedicated base model class without a language modeling head, aligning them with the design of Vision Language Models (VLMs); users relying on the previous model class structure should update their code to use the new base model class where appropriate.
Parallelization
This release includes numerous bug fixes for model parallelism across multiple models (Gemma4, AltCLIP, ChineseClip, Blip-2, Whisper, Ovis2, Moshi) and parallel execution strategies, including fixes for tensor parallelism (TP), expert parallelism (EP), beam search under model parallel settings, and loss over-counting under TP/EP configurations. The continuous batching manager was also reworked for clearer control flow and improved TP race condition handling, and FSDP initialization via
from_pretrainedwas introduced.Revert] FSDP+Dtensor refactor related changes (#46246) by @vasqu in [#46246]create_bidirectional_mask(#46221) by @kaixuanliu in [#46221]Cache
Fixed a regression in encoder-decoder cache initialization where the decoder config was incorrectly applied to the cross-attention cache, and resolved a
RuntimeErrorcaused by buffer size limits when warming up the cache on MPS devices. Additional test infrastructure improvements were made to support read-only cache environments used in CI.RuntimeErroron mps (#46239) by @McPatate in [#46239]Quantization
Added support for DeepGEMM BF16, mixed FP8/FP4, and MegaMoE quantization via a grouped linear refactor, while fixing two bugs: an FP8 MoE reverse substring issue affecting DSv4 initialization, and a BitsAndBytes 4-bit/8-bit quantization bug that silently dropped chunked tensors from one-to-many weight converters.
Bugfixes and improvements
contributing.md,modular_transformers.md,multimodal_processing.md,add_vision_processing_components.md,add_audio_processing_components.md,modeling_rules.md,model_output_tracing.md,auto_docstring.md,testing.md,pr_checks.mdandadd_new_model.md. (#46345) by @filipinescu in [#46345]weightconverter.md,models.md,custom_models.md,monkey_patching.md,fusion_mapping.md,how_to_hack_models.md,model_sharing.mdandserialization.md. (#46309) by @filipinescu in [#46309]StaticCachebuilding an empty layer list whennum_kv_shared_layers == 0(#46235) by @tengomucho in [#46235]Configs] Fix layer type validation to include its mlp counterpart (#46220) by @vasqu in [#46220]num_items_in_batchover-counting for causal LM losses (#46204) by @qgallouedec in [#46204]maininstead of commit SHA for now (#46241) by @ydshieh in [#46241]Significant community contributions
The following contributors have made significant changes to the library over the last release:
contributing.md,modular_transformers.md,multimodal_processing.md,add_vision_processing_components.md,add_audio_processing_components.md,modeling_rules.md,model_output_tracing.md,auto_docstring.md,testing.md,pr_checks.mdandadd_new_model.md. (#46345)weightconverter.md,models.md,custom_models.md,monkey_patching.md,fusion_mapping.md,how_to_hack_models.md,model_sharing.mdandserialization.md. (#46309)create_bidirectional_mask(#46221)Mellumv2 code generation model (#46112)Revert] FSDP+Dtensor refactor related changes (#46246)Configs] Fix layer type validation to include its mlp counterpart (#46220)v5.10.0Compare Source
v5.9.0Compare Source
Release v5.9.0
New Model additions
Cohere2Moe
Command A+ is a Mixture-of-Experts (MoE) language model from Cohere that features a hybrid attention pattern combining sliding window and full attention layers. The model incorporates both shared and routed experts and supports a very large context window for processing extensive text sequences.
Links: Documentation
Parakeet tdt (#44171)
HRM-Text
HRM-Text is an improved autoregressive language-modeling variant of the Hierarchical Reasoning Model (HRM) that uses a hierarchical recurrent forward pass with two transformer stacks - one for slow, abstract planning (H) and one for fast, detailed computation (L) - reused inside a nested recurrence. It features PrefixLM attention where instruction tokens attend bidirectionally while response tokens attend causally, per-head sigmoid output gates, and parameterless RMSNorm. The model is designed as a base language model without instruction tuning or chat templates.
Links: Documentation | Paper
Breaking changes
The
text_embedsinput for SAM3, EdgeTAM, and SAM3-Lite-Text models now expects full text embeddings instead of just pooler outputs, aligning with other models in the library — users must update their inputs accordingly.Audio
Audio support was expanded with the addition of AudioFlamingoNext model checkpoints and improved compilability of audio/vision encoders via standalone pure functions. Additional improvements include better error messaging when loading audio from video files and new documentation for audio/video processors.
Generation
Fixed generation issues including
inputs_embedsandper_layer_inputshandling for Gemma4, anAttributeErrorin RAG'sgenerate()caused by missing config fields, and flaky VLM generation tests by blocking special image tokens during sampling.Bugfixes and improvements
masking_utils.py(#46066) by @Cyrilvallez in [#46066]huggingface.codomain in prose links (#46042) by @kiwigitops in [#46042]HRM Text] Add integration tests (#46033) by @vasqu in [#46033]Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.