EUVD-2026-55743
GHSA-4j2p-28q2-5m79
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector because the malicious checkpoint must be on-disk; PR:N since no OS credentials are needed; UI:R for the required checkpoint-load action; C:H and A:H for file-read and DoS; I:N as no write primitive exists in the described behavior.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3Blast Radius
ecosystem impact- 7 pypi packages depend on accelerate (6 direct, 1 indirect)
Ecosystem-wide dependent count for version 1.14.0.
DescriptionCVE.org
Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in load_checkpoint_in_model and load_checkpoint_and_dispatch functions that fail to sanitize weight_map entries from sharded checkpoint indexes. Attackers can supply relative paths with ../ sequences or absolute paths to read arbitrary files, or point shard entries at named pipes to cause indefinite blocking and denial of service.
AnalysisAI
Path traversal in Hugging Face Accelerate through 1.14.0 exposes two distinct attack outcomes when a user loads a crafted sharded checkpoint: sensitive file disclosure via relative (../) or absolute path entries in the weight_map index, and indefinite process blocking via named pipe references enabling denial of service. A publicly available proof-of-concept exists at GitHub issue #4067, reported by VulnCheck. With no system-level privileges required (PR:N per CVSS 4.0), this is a supply chain risk for any ML practitioner who loads untrusted model checkpoints - particularly from public model registries - without needing any foothold on the target system beyond delivering the malicious checkpoint.
Technical ContextAI
Hugging Face Accelerate is a Python library abstracting multi-GPU and distributed training for PyTorch and other frameworks. Sharded checkpoint loading - splitting large model weights across multiple shard files - is coordinated through an index file (e.g., model.safetensors.index.json) whose weight_map field maps parameter names to shard filenames. The functions load_checkpoint_in_model and load_checkpoint_and_dispatch read this index and open each listed shard using os.path.join(checkpoint_folder, shard_file). Prior to the fix in PR #4070, no validation confirmed that the resolved path remained inside checkpoint_folder, instantiating CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Python's os.path.join silently discards preceding components when an absolute path segment is encountered, and ../ sequences are resolved by the OS - both enabling directory escape. A second attack surface exists when shard entries point to named pipes (FIFOs), causing open() to block indefinitely and denying service. The affected CPE is cpe:2.3:a:huggingface:accelerate:*:*:*:*:*:*:*:*, covering all Accelerate versions through 1.14.0.
RemediationAI
Upstream fixes are available in GitHub PRs #4070 (https://github.com/huggingface/accelerate/pull/4070) and #4138 (https://github.com/huggingface/accelerate/pull/4138). PR #4070 adds path validation in load_checkpoint_in_model that resolves each shard path with os.path.abspath and rejects any entry that does not start with checkpoint_folder_abs, raising a ValueError before any file is opened. No tagged Accelerate release version incorporating these fixes is confirmed from the provided data - users must monitor the official Accelerate releases page and the VulnCheck advisory at https://www.vulncheck.com/advisories/hugging-face-accelerate-path-traversal-and-dos-via-weight-map for a confirmed patched version. As an immediate compensating control, audit weight_map entries in any third-party checkpoint index file before loading - reject entries containing ../ sequences, leading slashes, or paths pointing outside the checkpoint directory. Running checkpoint loading inside a container with a read-only bind-mount limited to the checkpoint directory eliminates the file-read vector but does not eliminate the named-pipe DoS unless the sandbox also restricts FIFO access.
More in Hugging Face
View allThe huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
Arbitrary Python code execution in LMDeploy 0.12.1 through 0.12.2 lets an attacker who publishes a malicious model on Hu
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36. Rated high severity (CVSS
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36. Rated high severity (CVSS
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository,
Path traversal in Hugging Face Datasets up to 5.0.0 allows attackers to read arbitrary local files when a victim process
Server-side request forgery in HuggingFace text-generation-inference through version 3.3.7 enables unauthenticated remot
A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, spe
Remote code execution in Hugging Face Transformers 5.2.0 allows a malicious model repository to bypass the user's explic
XPath injection in Hugging Face Smolagents 1.20.0 lets an attacker who can influence the text passed to the vision web b
Unauthenticated remote code execution in HuggingFace LeRobot (versions 0 through 0.5.1) stems from pickle.loads() being
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, sp
Same weakness CWE-22 – Path Traversal
View allSame technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today