java-topology/whitepaper/outreach/transformers-0002.md

Hugging Face Transformers — CWE-312 Disclosure Brief (transformers-0002)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One CWE-312 credential exposure defect in Transformers' RegNet conversion script. The HuggingFace Hub authentication token is logged verbatim to stdout. Patched.

The Defects

transformers-0002 (PATCHED — MEDIUM): src/transformers/models/regnet/convert_regnet_seer_10b_to_pytorch.py:236

# In convert_weights_and_push() — fires when push_to_hub=True:
logger.info(f"Token is {os.environ['HF_TOKEN']}")

This line logs the full HuggingFace Hub authentication token to stdout/log output. The token grants write access to the user's HuggingFace Hub account, including publishing model revisions to public and private repositories.

Impact

Conversion scripts run by maintainers and contributors. CI logs, shared terminal sessions, and log aggregation systems capture the plaintext token. The HF_TOKEN is a long-lived secret with push access to model repositories.

The Fix

transformers-0002: Remove the token log line; log a safe diagnostic instead:

# Before — logs credential verbatim
logger.info(f"Token is {os.environ['HF_TOKEN']}")

# After — no credential exposure
logger.info("Pushing model to the Hub (token loaded from HF_TOKEN env var).")

Patch

Fix available: defects/transformers-0002/patch/transformers-0002-regnet-hf-token-logged.patch

Single-file patch in src/transformers/models/regnet/convert_regnet_seer_10b_to_pytorch.py.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a GitHub issue reference (huggingface/transformers).
2. Assess severity — logs live authentication token granting write access to Hub repos.
3. Coordinate a disclosure date — we are targeting 90 days from first contact.
4. We will credit the Hugging Face team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.