CVE-2024-3568: Critical Pickle Deserialization in Transformers

CVE-2024-3568 is a critical flaw (CVSS 9.6) in the Hugging Face Transformers library. The TensorFlow load_repo_checkpoint function used pickle.load on checkpoint data, so loading a malicious checkpoint could run attacker code. The upstream fix removed the function. The record gives no version number, so check the release notes for your build.

Weakness class: CWE-502.

What's affected

• Product: huggingface/transformers, Python library. The record lists affected versions only as a wildcard.
• Component: the load_repo_checkpoint() method of TFPreTrainedModel.
• Fix: the linked commit, titled "Remove dead TF loading code" (pull request 28926), deletes the method from src/transformers/modeling_tf_utils.py. The commit page does not state a release number.
• Severity: Critical, CVSS 9.6, per the record. The KEV flag is false.
• Fixed version: not confirmed here. Check the Transformers release notes for the first release that contains that commit.

How to check if you're exposed

1. List installed versions: run pip show transformers or pip list | grep -i transformers in each environment.
2. Search your code for the call: run grep -rn "load_repo_checkpoint" . across training scripts and notebooks.
3. Review any workflow that loads TensorFlow checkpoints, particularly ones pulled from a Hub repository or shared folder that you do not control.
4. Scan your lock files and notebooks with the free in-browser dependency scan to find every environment carrying the library.

What to do now

1. Upgrade transformers to a release that includes the removal commit, confirmed from the project release notes.
2. Stop calling load_repo_checkpoint. If you need to resume training, load weights with a method that does not unpickle.
3. Treat checkpoint files from outside your team as code, because pickle can execute code on load.
4. Run training and evaluation jobs in isolated containers with no standing credentials.
5. Prefer formats such as safetensors for model weights where your tooling supports them.

Why it matters

The class is CWE-502, deserialization of untrusted data. Python's pickle format is not just data. Loading it can call arbitrary functions, which is why the documentation warns never to unpickle anything you do not trust. The record says an attacker can deceive a victim into loading a seemingly harmless checkpoint during normal training.

Machine learning teams share checkpoints constantly, between researchers, through hubs and in shared buckets. That social habit is what makes this class dangerous in AI pipelines: the exploit is a file that looks like routine work.

The upstream response was to delete the function entirely, which is the cleanest remedy. If your code depended on it, you now have a migration to do, and that is better than keeping an unpickling path alive.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• https://github.com/huggingface/transformers/commit/693667b8ac8138b83f8adb6522ddaf42fa07c125
• Gold entry for CVE-2024-3568

Last reviewed: 19 October 2026.