Path Traversal Vulnerability in Hugging Face Transformers by Hugging Face

CVE-2026-9856

What is CVE-2026-9856?

A vulnerability exists in Hugging Face Transformers that allows attackers to perform arbitrary file writes due to improper validation of filenames in the 'save_pretrained()' methods. When user input from the 'chat_template' dictionary is used directly as filenames, malicious actors can craft a harmful 'tokenizer_config.json' file within a Hugging Face Hub repository. This can lead to unauthorized file manipulations when the affected tokenizer or processor is downloaded and executed, impacting various processors that inherit from the 'ProcessorMixin', including Idefics, Florence, Gemma, Phi, and Qwen-VL.

References