Hugging Face Transformers: Transformers save_pretrained path traversal allows arbitrary file writes through chat template…
Hugging Face Transformers
More for Hugging Face Transformers RSS feed for Hugging Face Transformers
- Severity
- High, CVSS 7.1
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
- Record
- CVE-2026-9856
- Affects
- Hugging Face Transformers
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 2, 2026
- Source last modified
- September 1, 2026
Description
A vulnerability in huggingface/transformers versions < 5.10.0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the save_pretrained() methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chat_template dictionary are used directly as filenames without proper validation. An attacker can exploit this by publishing a malicious Hugging Face Hub repository with a crafted tokenizer_config.json file. When a victim downloads and saves the tokenizer or processor, the attacker-controlled keys can escape the intended save directory, enabling arbitrary file writes with attacker-controlled content. This vulnerability affects multiple processors inheriting from ProcessorMixin, including Idefics, Florence, Gemma, Phi, and Qwen-VL.
Description quoted from the NVD record.
Who is affected
Hugging Face Transformers is a software toolkit that programmers use to work with AI models. This flaw affects all versions before 5.10.0. It can be triggered when someone downloads a tokenizer or processor (the parts that prepare input for a model) from a booby-trapped model repository on the Hugging Face Hub and then saves it. An attacker who publishes such a repository could write files with contents of their choosing to places on that computer outside the intended folder. Processors for several model families are affected, including Idefics, Florence, Gemma, Phi and Qwen-VL. This flaw is rated High.
What to do
- Ask your developers or data staff whether anyone in your organization uses Hugging Face Transformers, for example in scripts or AI projects.
- The person who installed or runs it should update the
transformerspackage to version5.10.0or later on every computer and server where it is used. - If an IT provider or vendor manages these systems for your organization, send them this advisory and ask when the update will be done.
- For more detail on the fix, check the vendor advisory linked on this page.
Analysis written from the source record as of September 1, 2026 and reviewed before publishing.