CVE-2025-14929

CVE-2025-14929 is a remote code execution vulnerability affecting Hugging Face Transformers, specifically within the X-CLIP checkpoint conversion process. It stems from improper validation of user-supplied data, leading to deserialization of untrusted data. With a CVSS score of 7.8 (HIGH), successful exploitation requires user interaction, such as visiting a malicious page or opening a malicious file, allowing an attacker to execute arbitrary code in the context of the current process. There is currently no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this vulnerability.