Aller au contenu
en Se connecter
7.1 Élevée

CVE-2026-9856 A vulnerability in huggingface/transformers…

Description

A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the `save_pretrained()` methods of `PreTrainedTokenizerBase` and `ProcessorMixin`, where keys from the `chat_template` dictionary are used directly as filenames without proper validation. An attacker can exploit this by publishing a malicious Hugging Face Hub repository with a crafted `tokenizer_config.json` file. When a victim downloads and saves the tokenizer or processor, the attacker-controlled keys can escape the intended save directory, enabling arbitrary file writes with attacker-controlled content. This vulnerability affects multiple processors inheriting from `ProcessorMixin`, including Idefics, Florence, Gemma, Phi, and Qwen-VL.

Produits et versions touchés

Produit Versions touchées Corrigé en
huggingface/transformers 5.10 premières → < 5.10.0 5.10.0

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de huggingface/transformers

Les 20 CVE de huggingface/transformers →
CVE-2026-5241 A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an… 8.0 Élevée CVE-2026-4372 A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to… 7.8 Élevée CVE-2026-1839 A vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary… 6.5 Moyenne CVE-2025-6921 The huggingface/transformers library, versions prior to 4.53.0, is vulnerable to Regular Expression Denial of Service… 5.3 Moyenne
Suivre cette CVE