CVE-2025-14930

CVE-2025-14930 is a critical remote code execution vulnerability affecting Hugging Face Transformers, specifically within the GLM4 model's weight parsing. This flaw, stemming from improper validation of user-supplied data leading to untrusted deserialization, allows attackers to execute arbitrary code if a user visits a malicious page or opens a malicious file. Rated 7.8 HIGH on the CVSS scale, it requires user interaction but can lead to full compromise of the affected process. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.