A vulnerability has been found in huggingface transformers up to 5.0.0rc2 and classified as problematic. This affects the function
_load_rng_state of the file src/transformers/trainer.py. The manipulation leads to deserialization.
This vulnerability is referenced as CVE-2026-1839. The attack can only be performed from a local environment. No exploit is available.
The affected component should be upgraded.
