A maliciously crafted configuration file can place a special internal field that points to an attacker‑controlled repository. When a user loads a model through the normal "AutoModelForCausalLM.from_pretrained()" call, the library downloads and runs the code from that repository with the full privileges of the current process. This allows an adversary to execute arbitrary Python code on the host. The weakness falls under CWE‑1066 (Untrusted Input Sanitation) and CWE‑502 (Deserialization of Untrusted Data) and is classified with a CVSS score of 7.8, a high‑severity rating that reflects the potential to compromise confidentiality, integrity, and availability.

All releases of the HuggingFace Transformers library older than 5.3.0 are affected, regardless of the host operating system. The vulnerability impacts any installation that pulls models from the HuggingFace Hub via the standard API.

Because the attack relies on a legitimate model download, the vector is inferred from the description; the description does not explicitly state the exact attack path, but it is clear that a malicious repository ID in a config.json triggers code execution. The vulnerability bypasses the trust_remote_code safeguard and has an EPSS score of 0.00032 (0.032%), indicating a low probability of exploitation at present but the potential impact remains severe. The CVSS score of 7.8 highlights that the risk is high, and that once exploited, an attacker would gain full operating‑system privileges on the victim’s machine.