A maliciously crafted configuration file can place a special internal field that points to an attacker‑controlled repository. When a user loads a model through the normal "AutoModelForCausalLM.from_pretrained()" call, the library downloads and runs the code from that repository with the full privileges of the current process. This allows an adversary to execute arbitrary Python code on the host. The weakness falls under CWE‑1066 and is classified with a CVSS score of 7.8, a high‑severity rating that reflects the potential to compromise confidentiality, integrity, and availability.

All releases of the HuggingFace Transformers library older than 5.3.0 are affected, regardless of the host operating system. The vulnerability impacts any installation that pulls models from the HuggingFace Hub via the standard API.

Because the attack relies on a legitimate model download, the vector is inferred from the description; the description does not explicitly state the exact attack path, but it is clear that a malicious repository ID in a config.json triggers code execution. The vulnerability bypasses the trust_remote_code safeguard and shows no EPSS score, indicating that widespread exploitation has not yet been observed but the potential impact remains severe. The CVSS score of 7.8 highlights that the risk is high, and that once exploited, an attacker would gain full operating‑system privileges on the victim’s machine.