Arbitrary Remote Code Execution via `_attn_implementation_internal` Config Injection in huggingface/transformers

@@ -263,11 +263,13 @@ def __init__(
 
         # Additional attributes without default values
         for key, value in kwargs.items():
-            try:
-                setattr(self, key, value)
-            except AttributeError as err:
-                logger.error(f"Can't set {key} with value {value} for {self}")
-                raise err
+            # Check this to avoid deserializing problematic fields from hub configs - they should use the public field
+            if key not in ("_attn_implementation_internal", "_experts_implementation_internal"):
+                try:
+                    setattr(self, key, value)
+                except AttributeError as err:
+                    logger.error(f"Can't set {key} with value {value} for {self}")
+                    raise err
 
     def _create_id_label_maps(self, num_labels: int):
         self.id2label = {i: f"LABEL_{i}" for i in range(num_labels)}

@@ -290,10 +290,21 @@ def register_kernel_mapping_transformers(*args, **kwargs):
 
 def is_kernel(attn_implementation: str | None) -> bool:
     """Check whether `attn_implementation` matches a kernel pattern from the hub."""
-    return (
-        attn_implementation is not None
-        and re.search(r"^[^/:]+/[^/:]+(?:@[^/:]+)?(?::[^/:]+)?$", attn_implementation) is not None
-    )
+    if attn_implementation is None:
+        return False
+    match_object = re.search(r"^(?:paged\|)?([^/:]+)/[^/:]+(?:@[^/:]+)?(?::[^/:]+)?$", attn_implementation)
+    if match_object is not None:
+        # Due to security reason, we only allow kernels from the `kernels-community` repo, as otherwise loading
+        # random kernels will lead to arbitrary code execution
+        repo_id = match_object.group(1)
+        if repo_id != "kernels-community":
+            logger.warning_once(
+                "For security reasons, we currently only accept kernels from the `kernels-community` repository. We "
+                f"will skip kernel from `{repo_id}`"
+            )
+            return False
+        return True
+    return False
 
 
 def load_and_register_attn_kernel(