EUVD-2026-52005
GHSA-xrqw-3rrv-vx5w
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Attacker delivers payload via network-hosted Hub repo (AV:N, AC:L, PR:N); victim must explicitly call save_pretrained (UI:R); arbitrary file write yields high integrity impact with no scope change or confidentiality loss.
Primary rating from Vendor (huntr_ai).
CVSS VectorVendor: huntr_ai
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the save_pretrained() methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chat_template dictionary are used directly as filenames without proper validation. An attacker can exploit this by publishing a malicious Hugging Face Hub repository with a crafted tokenizer_config.json file. When a victim downloads and saves the tokenizer or processor, the attacker-controlled keys can escape the intended save directory, enabling arbitrary file writes with attacker-controlled content. This vulnerability affects multiple processors inheriting from ProcessorMixin, including Idefics, Florence, Gemma, Phi, and Qwen-VL.
AnalysisAI
Arbitrary file write via path traversal in HuggingFace Transformers (<=5.8.0.dev0, fixed in 5.10.0) enables a supply-chain attacker to overwrite arbitrary files on a victim's filesystem. The flaw exists in save_pretrained() methods of PreTrainedTokenizerBase and ProcessorMixin, where dictionary keys from the chat_template field in a downloaded tokenizer_config.json are used verbatim as filenames with no path sanitization. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must call `save_pretrained()` on a tokenizer (subclass of `PreTrainedTokenizerBase`) or processor (subclass of `ProcessorMixin`) that was loaded from an attacker-controlled or attacker-influenced HuggingFace Hub repository. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.0 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L, score 7.1) accurately captures the threat model: network-delivered via a malicious Hub repository, no complexity or privilege requirement on the attacker side, but requiring explicit user interaction (UI:R) to call `save_pretrained()`. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker creates a HuggingFace Hub repository containing a `tokenizer_config.json` where the `chat_template` field is a dictionary with a malicious key such as `../../.ssh/authorized_keys`, mapped to attacker-controlled SSH public key content. When a victim's automated ML pipeline calls `AutoTokenizer.from_pretrained('attacker/malicious-model')` followed by `tokenizer.save_pretrained('/workspace/models/my-model')`, the library writes the attacker's content to `/workspace/models/my-model/additional_chat_templates/../../.ssh/authorized_keys`, resolving to the victim's SSH authorized_keys file and granting the attacker remote access. … |
| Remediation | Upgrade HuggingFace Transformers to version 5.10.0 or later, which includes the path traversal fix from commit eaaaf8494dd5386634ae37d1d122212fdc315be5. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running HuggingFace Transformers versions 5.8.0.dev0 or earlier across development, testing, research, and production ML pipelines; prepare version 5.10.0 for staged rollout. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Huggingface Transformers
View allRemote code execution in HuggingFace Transformers prior to 5.3.0 allows attackers to achieve arbitrary code execution on
Remote code execution in HuggingFace Transformers library allows arbitrary code execution via malicious checkpoint files
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today