The Git Gazette

Something strange is brewing in the wires. Two CVE numbers — CVE-2026-33671 and CVE-2026-33672 — surfaced in recent PRs for the Hugging Face tokenizers repository, but here's the kicker: these CVEs don't exist. Not yet, anyway.

CVE-2026? That's next year's numbering scheme. Either someone's operating with a crystal ball, or we've got misreported identifiers in the wild. I've run these numbers through MITRE, NVD, and every vulnerability database in my arsenal. Nothing. Nada. Zero hits.

For a repository handling tokenization for some of the world's most critical AI workloads — BERT, GPT, you name it — phantom CVE references are more than just clerical errors. They're noise in the signal when security teams are trying to assess real risk.

The security posture shows clean: no unpatched vulnerabilities, no recent security patches. That's the good news. But the absence of a SECURITY.md file in a repo with 10.5k stars? That's a communication gap we need to address.

Wiresec Assessment: 🚨 (1/5) — False alarm, but worth investigating

Action Item: Monitor the referenced PRs for context. If you're depending on tokenizers in production, you're still clear to proceed — but keep your feeds tuned to the official channels, not ghost signals.

BREAKING: The Huggingface tokenizers repo has been a hotbed of heated exchanges this week, and let me tell you, the proceedings have been anything but routine.

First up in our courtroom of code: Issue #1975 has @nicezic proposing a revolutionary Korean jamo decomposition system. But wait — there's a plot twist! The conversation suddenly switches to Korean mid-thread, leaving English-only witnesses scrambling for context. "BTW, this is for Korean," @nicezic casually drops, as if we hadn't already figured that out from the Hangul characters flooding the comment section. @ArthurZucker seems receptive, but the architectural questions remain unanswered. Will this be a pre-tokenizer or normalizer? The suspense is killing us.

Meanwhile, issue #1954 brings us pure drama gold: @BBC-Esq drops a Medium article with "constructive criticism" that sounds more like a therapy session. "It's been the bane of my existence, literally a mental struggle for months," they confess. Both @ArthurZucker and @tomaarsen rush to provide support like digital first responders. Sometimes the real tokenization was the friends we made along the way.

And in a classic case of digital decay, issue #1910 quietly reported dead documentation links before closing without fanfare. Not every issue gets its moment in the spotlight, folks.

Stay tuned for next week's installment!