CVE-2026-9856 Details
Description
A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the `save_pretrained()` methods of `PreTrainedTokenizerBase` and `ProcessorMixin`, where keys from the `chat_template` dictionary are used directly as filenames without proper validation. An attacker can exploit this by publishing a malicious Hugging Face Hub repository with a crafted `tokenizer_config.json` file. When a victim downloads and saves the tokenizer or processor, the attacker-controlled keys can escape the intended save directory, enabling arbitrary file writes with attacker-controlled content. This vulnerability affects multiple processors inheriting from `ProcessorMixin`, including Idefics, Florence, Gemma, Phi, and Qwen-VL.
A path traversal vulnerability allowing arbitrary file writes has been identified in Hugging Face Transformers versions through 5.8.0.dev0. The issue arises in the `save_pretrained()` methods of `PreTrainedTokenizerBase` and `ProcessorMixin`. Here, keys from the `chat_template` dictionary are used as filenames without adequate validation. An attacker could exploit this by creating a malicious Hugging Face Hub repository containing a crafted `tokenizer_config.json` file. When a user downloads and saves the tokenizer or processor, the attacker-controlled keys can escape the designated save directory, leading to unauthorized file writes with attacker-specified content. This vulnerability impacts several processors that inherit from `ProcessorMixin`, including Idefics, Florence, Gemma, Phi, and Qwen-VL.
Users can update to Hugging Face Transformers version 5.14.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 2, 2026 | New CVE Received | [email protected] |