This may help
Could someone hack a tails device based on the firmware in it?Could Tor be hacked, revealing users' personal info?
"all software is subject to flaws, both in design and implementation. Tor has had them in the past, Tor also relies on OpenSSL which has had numerous vulernabilities. However, only your guard or a man-in-the-middle between your guard and you can attack a Tor clients OpenSSL.
The far larger problem, and the source of most of the large-scale hacks performed on Tor users is through the application that the user is using over Tor. For example, Tor Browser has regular updates that fix vulnerabilities."