Remote Code Execution in Hugging Face Transformers Agent via Deserialization of Untrusted Data
Overview
A critical remote code execution (RCE) vulnerability was discovered in the Hugging Face Transformers library's experimental agent functionality. The vulnerability, tracked as CVE-2026-24110, stems from the agent's use of Python's `pickle` module to deserialize tool outputs when executing complex, multi-step tasks. An attacker could craft a malicious output from a compromised or custom tool, which, when processed by the agent, would be deserialized unsafely. This allows for the execution of arbitrary Python code on the host system running the Transformers agent. The impact is severe, as it enables a complete system compromise, including data theft, model manipulation, and lateral movement within the host network. The vulnerability was discovered by security researchers at Trail of Bits during a security audit of popular AI agentic frameworks. The flaw exists because the agent implicitly trusts the data returned from the tools it calls, failing to validate or sanitize it before deserialization. This is particularly dangerous in scenarios where agents interact with external APIs or web content, as an attacker could inject a malicious payload into the data source the agent is processing, leading to RCE.
Affected Systems
Testing Guide
1. Check your installed `transformers` version using `pip show transformers`. 2. Create a PoC tool that returns a pickled payload designed to execute a simple command, such as `os.system('touch /tmp/pwned')`. 3. Configure a Transformers agent to use this malicious tool. 4. Execute a prompt that triggers the tool. 5. Check for the existence of the file `/tmp/pwned` on the host system. If the file is created, your system is vulnerable.
Mitigation Steps
1. Immediately update the `transformers` library to version `4.42.2` or later by running `pip install --upgrade transformers`. 2. If immediate patching is not possible, disable the experimental agent feature (`Agent`) or avoid using it with tools that process untrusted external data. 3. Replace the default `pickle`-based tool data handler with a safer serialization format like JSON. This can be achieved by subclassing the agent and overriding the relevant methods. 4. Run the agent in a sandboxed, containerized environment with strict network egress policies and minimal permissions to limit the impact of a potential compromise.
Patch Details
Patched in Hugging Face Transformers version 4.42.2. The fix replaces the use of `pickle` with the safer `safetensors` library for tool state serialization.