StackRadar

CVE-2026-4372

High

Advisory

Published 24 May 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.8
base score, highest
EPSS
0.005
40th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
21
of 17,781 indexed, latest versions
Container images
18
deployed by those charts
Fix available
1 of 1
affected package

HuggingFace transformers vulnerable to remote code execution

Carried by container images the latest versions of 21 of 17,781 indexed charts deploy, on 18 images.

Affected packageAffected versionsFixed inImages
transformerspypi4.35.2, 4.41.2, 4.44.0, 4.44.2+3 more5.3.018
OSV records
GHSA-29pf-2h5f-8g72
Also known as
PYSEC-2026-2289

Charts affected

21 by stars
ChartLatestAffected imagesRadar Score
syftopenmined0.9.51 of 6See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry CVE-2026-4372.

Container imageDigestPackageFixed in
openmined/syft-backend:0.9.5b72f74a68b32
transformers@4.41.2
5.3.0

Open the chart page →

17,245
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-4372.

Container imageDigestPackageFixed in
langgenius/dify-api:0.6.11fca918260dd6
transformers@4.35.2
5.3.0

Open the chart page →

20,403
akto-ai-guardrails-v2akto0.3.01 of 6See more

akto-ai-guardrails-v2 akto 0.3.0

1 of the 6 container images this version deploys carry CVE-2026-4372.

Container imageDigestPackageFixed in
aktosecurity/akto-agent-guard-embedder:1.1.4dbc566b2376c
transformers@4.57.6
5.3.0

Open the chart page →

9,321
csgshipcsghubVerified publisher0.4.61 of 10See more

csgship csghub 0.4.6

1 of the 10 container images this version deploys carry CVE-2026-4372.

Container imageDigestPackageFixed in
opencsghq/csgship-web:v0.4.0c36a5bac3cf0
transformers@4.44.0
5.3.0

Open the chart page →

11,335
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-4372.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
transformers@4.35.2
5.3.0

Open the chart page →

19,224
guardrails-usvcinfracloud-chartsVerified publisher1.0.11 of 1See more

guardrails-usvc infracloud-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-4372.

Container imageDigestPackageFixed in
opea/guardrails-tgi:latestf68bec6a1271
transformers@4.47.1
5.3.0

Open the chart page →

5,062
chatbot-ai-sampleopenshift0.1.61 of 4See more

chatbot-ai-sample openshift 0.1.6

1 of the 4 container images this version deploys carry CVE-2026-4372.

Container imageDigestPackageFixed in
quay.io/ai-lab/llamacpp_python:latest70d138997acd
transformers@4.41.2
5.3.0

Open the chart page →

18,922
wyoming-faster-whisperschoolguys-helmcharts0.1.41 of 1See more

wyoming-faster-whisper schoolguys-helmcharts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-4372.

Container imageDigestPackageFixed in
rhasspy/wyoming-whisper:3.5.0308b7959a925
transformers@4.52.4
5.3.0

Open the chart page →

2,291
asrtest-opea1.0.01 of 1See more

asr test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-4372.

Container imageDigestPackageFixed in
opea/asr:1.025dd26d9cd09
transformers@4.44.2
5.3.0

Open the chart page →

4,393
chatqnatest-opea1.0.04 of 11See more

chatqna test-opea 1.0.0

4 of the 11 container images this version deploys carry CVE-2026-4372.

Container imageDigestPackageFixed in
opea/embedding-tei:1.05c9639de61c1
transformers@4.44.2
5.3.0
opea/llm-tgi:1.00c25aab3f106
transformers@4.44.2
5.3.0
opea/reranking-tei:1.0e48613afb191
transformers@4.44.2
5.3.0
opea/retriever-redis:1.0eb746b263705
transformers@4.44.2
5.3.0

Open the chart page →

39,090
codegentest-opea1.0.01 of 5See more

codegen test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-4372.

Container imageDigestPackageFixed in
opea/llm-tgi:1.00c25aab3f106
transformers@4.44.2
5.3.0

Open the chart page →

28,814
codetranstest-opea1.0.01 of 5See more

codetrans test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-4372.

Container imageDigestPackageFixed in
opea/llm-tgi:1.00c25aab3f106
transformers@4.44.2
5.3.0

Open the chart page →

28,385
docsumtest-opea1.0.01 of 5See more

docsum test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-4372.

Container imageDigestPackageFixed in
opea/llm-docsum-tgi:1.002f9e8fa5d71
transformers@4.44.2
5.3.0

Open the chart page →

28,858
embedding-usvctest-opea1.0.01 of 1See more

embedding-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-4372.

Container imageDigestPackageFixed in
opea/embedding-tei:1.05c9639de61c1
transformers@4.44.2
5.3.0

Open the chart page →

5,185
guardrails-usvctest-opea1.0.01 of 1See more

guardrails-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-4372.

Container imageDigestPackageFixed in
opea/guardrails-tgi:1.0262c6048aab8
transformers@4.44.2
5.3.0

Open the chart page →

5,221
llm-uservicetest-opea1.0.01 of 1See more

llm-uservice test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-4372.

Container imageDigestPackageFixed in
opea/llm-tgi:1.00c25aab3f106
transformers@4.44.2
5.3.0

Open the chart page →

4,720
reranking-usvctest-opea1.0.01 of 1See more

reranking-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-4372.

Container imageDigestPackageFixed in
opea/reranking-tei:1.0e48613afb191
transformers@4.44.2
5.3.0

Open the chart page →

4,985
retriever-usvctest-opea1.0.01 of 1See more

retriever-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-4372.

Container imageDigestPackageFixed in
opea/retriever-redis:1.0eb746b263705
transformers@4.44.2
5.3.0

Open the chart page →

5,198
speecht5test-opea1.0.01 of 1See more

speecht5 test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-4372.

Container imageDigestPackageFixed in
opea/speecht5:1.0249afad3d268
transformers@4.44.2
5.3.0

Open the chart page →

9,616
ttstest-opea1.0.01 of 1See more

tts test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-4372.

Container imageDigestPackageFixed in
opea/tts:1.0257ae94709e9
transformers@4.44.2
5.3.0

Open the chart page →

4,377
web-retrievertest-opea1.0.01 of 1See more

web-retriever test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-4372.

Container imageDigestPackageFixed in
opea/web-retriever-chroma:1.0fe08165d7770
transformers@4.44.2
5.3.0

Open the chart page →

5,350

Container images carrying it

18 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
opea/llm-tgi:1.00c25aab3f106
transformers@4.44.2
5.3.0
4
opea/embedding-tei:1.05c9639de61c1
transformers@4.44.2
5.3.0
2
opea/reranking-tei:1.0e48613afb191
transformers@4.44.2
5.3.0
2
opea/retriever-redis:1.0eb746b263705
transformers@4.44.2
5.3.0
2
aktosecurity/akto-agent-guard-embedder:1.1.4dbc566b2376c
transformers@4.57.6
5.3.0
1
langgenius/dify-api:1.0.0066035f93856
transformers@4.35.2
5.3.0
1
langgenius/dify-api:0.6.11fca918260dd6
transformers@4.35.2
5.3.0
1
opea/asr:1.025dd26d9cd09
transformers@4.44.2
5.3.0
1
opea/guardrails-tgi:1.0262c6048aab8
transformers@4.44.2
5.3.0
1
opea/guardrails-tgi:latestf68bec6a1271
transformers@4.47.1
5.3.0
1
opea/llm-docsum-tgi:1.002f9e8fa5d71
transformers@4.44.2
5.3.0
1
opea/speecht5:1.0249afad3d268
transformers@4.44.2
5.3.0
1
opea/tts:1.0257ae94709e9
transformers@4.44.2
5.3.0
1
opea/web-retriever-chroma:1.0fe08165d7770
transformers@4.44.2
5.3.0
1
opencsghq/csgship-web:v0.4.0c36a5bac3cf0
transformers@4.44.0
5.3.0
1
openmined/syft-backend:0.9.5b72f74a68b32
transformers@4.41.2
5.3.0
1
rhasspy/wyoming-whisper:3.5.0308b7959a925
transformers@4.52.4
5.3.0
1
quay.io/ai-lab/llamacpp_python:latest70d138997acd
transformers@4.41.2
5.3.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.