Remote Code Execution in Hugging Face Hub via Malicious `pickle` in `safetensors` Conversion
Overview
A critical remote code execution (RCE) vulnerability was discovered in the Hugging Face Hub's model conversion service. The service, designed to automatically convert legacy model formats (like PyTorch's `.bin` files, which use Python's `pickle` serialization) into the safer `safetensors` format upon request, was found to insecurely deserialize user-provided model files. An attacker could upload a specially crafted `.bin` model file containing a malicious pickle payload. When any user (including the attacker) subsequently requested the `safetensors` version of this model via the Hub's interface or API, the backend conversion workers would load the malicious file. The `pickle.load()` operation would execute the embedded payload, achieving RCE on the Hugging Face infrastructure. This could allow an attacker to compromise the conversion service, potentially access or tamper with other models being processed, and pivot to other internal services. The discovery was made by a security researcher who reported it through Hugging Face's bug bounty program. The vulnerability underscores the persistent dangers of deserializing untrusted data, even within supposedly secure automated pipelines, and highlights the importance of sandboxing and memory-safe model formats.
Affected Systems
Testing Guide
1. Check your uploaded models on the Hugging Face Hub. 2. If you have models in legacy formats (`.bin`, `.pth`), attempt to download the `safetensors` version using the `from_pretrained('your-model', use_safetensors=True)` method in the `transformers` library. 3. If the conversion fails with a security-related error or is now blocked, the patch is likely active. If it succeeds, ensure you are using an updated version of the client library and that the model you are testing with is benign. 4. Note: Directly testing for the RCE is not advised and is against the terms of service of most platforms.
Mitigation Steps
1. For users, immediately migrate all private models to the `safetensors` format and delete the legacy `.bin` or `.pth` files to prevent accidental conversion requests. 2. For Hugging Face, the service was patched to use a safer deserialization process that blocks dangerous opcodes or runs the conversion in a tightly sandboxed, ephemeral environment with no network access. 3. Implement rigorous scanning of uploaded model files for known malicious pickle patterns before they are made available for conversion. 4. Avoid direct `pickle.load()` on any user-controllable data. Use safer serialization formats where possible.
Patch Details
Hugging Face deployed a server-side patch on 2026-06-13. No user action is required for protection, but migrating models to `safetensors` is strongly recommended.