EUVD-2026-52005
GHSA-xrqw-3rrv-vx5w
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Attacker delivers payload via network-hosted Hub repo (AV:N, AC:L, PR:N); victim must explicitly call save_pretrained (UI:R); arbitrary file write yields high integrity impact with no scope change or confidentiality loss.
Primary rating from Vendor (huntr_ai).
CVSS VectorVendor: huntr_ai
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the save_pretrained() methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chat_template dictionary are used directly as filenames without proper validation. An attacker can exploit this by publishing a malicious Hugging Face Hub repository with a crafted tokenizer_config.json file. When a victim downloads and saves the tokenizer or processor, the attacker-controlled keys can escape the intended save directory, enabling arbitrary file writes with attacker-controlled content. This vulnerability affects multiple processors inheriting from ProcessorMixin, including Idefics, Florence, Gemma, Phi, and Qwen-VL.
AnalysisAI
Arbitrary file write via path traversal in HuggingFace Transformers (<=5.8.0.dev0, fixed in 5.10.0) enables a supply-chain attacker to overwrite arbitrary files on a victim's filesystem. The flaw exists in save_pretrained() methods of PreTrainedTokenizerBase and ProcessorMixin, where dictionary keys from the chat_template field in a downloaded tokenizer_config.json are used verbatim as filenames with no path sanitization. An attacker need only publish a malicious model repository on HuggingFace Hub; exploitation is triggered when the victim calls save_pretrained() after loading the poisoned model. No active exploitation is confirmed (not in CISA KEV), but the attack surface spans all practitioners using the affected save_pretrained() path across multiple popular processor families.
Technical ContextAI
The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). In processing_utils.py and tokenization_utils_base.py, the save_pretrained() method serializes multi-template chat_template dictionaries by writing each value to a file named after the key (e.g., <key>.jinja) inside a additional_chat_templates/ subdirectory. Because keys are sourced from a downloaded tokenizer_config.json - attacker-controlled data - a key like ../../etc/cron.d/backdoor will resolve to a path outside the intended save directory. The fix (commit eaaaf8494dd5386634ae37d1d122212fdc315be5) adds a Path.resolve().parent equality check to reject any key whose resolved path does not remain within the designated chat template directory. The vulnerability affects all subclasses of ProcessorMixin (confirmed: Idefics, Florence, Gemma, Phi, Qwen-VL processors) and all tokenizers inheriting from PreTrainedTokenizerBase. The CPE is cpe:2.3:a:huggingface:huggingface/transformers:*:*:*:*:*:*:*:*.
RemediationAI
Upgrade HuggingFace Transformers to version 5.10.0 or later, which includes the path traversal fix from commit eaaaf8494dd5386634ae37d1d122212fdc315be5. The patch details and bounty context are available at https://huntr.com/bounties/362824d5-fe18-40e8-a6cf-62277f97a170 and https://github.com/huggingface/transformers/commit/eaaaf8494dd5386634ae37d1d122212fdc315be5. For teams that cannot immediately upgrade, the primary compensating control is to avoid calling save_pretrained() on tokenizers or processors loaded from untrusted or unvetted HuggingFace Hub repositories; restrict model loading to internally mirrored, audited repositories. Additionally, running inference and save operations in a sandboxed environment (e.g., a container with a read-only filesystem outside the designated model directory) will limit the blast radius of a successful exploit. Note that these workarounds impose operational friction for teams with automated model pipelines.
More in Hugging Face
View allThe huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
Arbitrary Python code execution in LMDeploy 0.12.1 through 0.12.2 lets an attacker who publishes a malicious model on Hu
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36. Rated high severity (CVSS
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36. Rated high severity (CVSS
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository,
Path traversal in Hugging Face Datasets up to 5.0.0 allows attackers to read arbitrary local files when a victim process
Path traversal in Hugging Face Accelerate through 1.14.0 exposes two distinct attack outcomes when a user loads a crafte
Server-side request forgery in HuggingFace text-generation-inference through version 3.3.7 enables unauthenticated remot
A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, spe
Remote code execution in Hugging Face Transformers 5.2.0 allows a malicious model repository to bypass the user's explic
XPath injection in Hugging Face Smolagents 1.20.0 lets an attacker who can influence the text passed to the vision web b
Unauthenticated remote code execution in HuggingFace LeRobot (versions 0 through 0.5.1) stems from pickle.loads() being
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today