CVE-2024-11392: Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to…

PriorityP268high8.8CVSS 3.1

AVNACLPRNUIRSUCHIHAH

EXPLOIT

EPSS

6.90%

93.3th percentile

Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of configuration files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-24322.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
hugging_face	transformers	—	—
huggingface	transformers	< 4.48.0	4.48.0
huggingface	transformers	>= 0 < 4.48.0	4.48.0

Detection & IOCsextracted from sources · hover to see the quote

filenametransformers_exploit.yaml↗

filenameconvert_mlcvnets_to_pytorch.py↗

commandpython convert_mlcvnets_to_pytorch.py --orig_checkpoint_path dummy_checkpoint.pt --orig_config_path transformers_exploit.yaml↗

bytes↗

!!python/object/new:type

→Monitor execution of convert_mlcvnets_to_pytorch.py with the --orig_config_path argument pointing to unexpected or externally-sourced YAML files, which is the direct attack vector for this CVE. ↗
→Detect YAML files containing the '!!python/object/new:type' tag combined with '!!python/name:exec' — this is the deserialization gadget chain used in the exploit payload. ↗
→Alert on processes spawned by Python that establish outbound socket connections immediately after loading a YAML config file, consistent with the reverse shell payload in the PoC. ↗
→Flag use of pty.spawn('/bin/bash') invoked from within a Python ML pipeline process, as this is indicative of the reverse shell stage of the exploit. ↗
→The vulnerability is triggered by opening a malicious configuration file; alert on users loading third-party ml-cvnet model config files from untrusted sources. ↗

·The affected version is Hugging Face Transformers 4.41.1; the vulnerability exists specifically in the MobileViTV2 model's configuration file handling via unsafe YAML deserialization. ↗
·User interaction is required — the target must open a malicious YAML configuration file or visit a malicious page; this is not a zero-click remote exploit. ↗
·Red Hat confirmed none of its shipped packages are affected; OpenShift Lightspeed and RHEL AI packages are explicitly listed as Not Affected. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vendor_redhat8.8HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.