Hugging Face Transformers: checkpoint index shard names traverse out of the model directory

Impact

Shard filenames listed inside a checkpoint index file are joined to the model directory without validation, so an index containing parent-directory references or absolute paths makes the loader open files anywhere the serving process can reach. On a GPU node the process doing the loading normally holds far more than the model: mounted Kubernetes service-account tokens, registry pull secrets, cloud credential files, SSH keys, other tenants' cached weights on a shared model volume. The record describes file disclosure and filesystem reconnaissance, not code execution. Exploitation needs someone to load the attacker-supplied checkpoint, which in practice is any pipeline that pulls model artefacts from a source users can influence.

Who can reach it

Anyone who can get a crafted checkpoint index in front of a loader - an uploaded model, a Hub repo, a shared artefact bucket. No authentication to the serving host is required, but a user or automated job must load the model (CVSS marks user interaction required).

What to do

The record points only at open upstream issues (47176, 47177) and no fixed release, so do not assume a patched version exists yet - check the Transformers releases before planning an upgrade. Until a fix lands, restrict which checkpoint sources your loaders accept, validate index files before use, and run loading workers with the smallest credential set that works rather than with the fleet's pull secrets mounted. When a fixed version ships, upgrading is a library bump and a restart of the serving process, not a node drain.

References