CVE-2025-14924

CVE-2025-14924 is a remote code execution vulnerability affecting Hugging Face Transformers, specifically within the megatron_gpt2 component. It stems from improper validation during checkpoint parsing, allowing deserialization of untrusted data. Rated 7.8 HIGH (CVSSv3), exploitation requires user interaction, such as visiting a malicious page or opening a malicious file, but can lead to full compromise of the affected system. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.