Hugging Face Transformers: path traversal in save_pretrained() writes files outside the save directory

Impact

Keys of the chat_template dictionary in tokenizer_config.json are used directly as filenames when a tokenizer or processor is re-saved, with no validation. A model repository on the Hub can therefore carry a crafted config whose keys traverse out of the intended output directory, so that any pipeline which downloads that repo and calls save_pretrained() writes attacker-controlled content to an attacker-chosen path with the privileges of the job. On a GPU fleet this is the normal shape of a fine-tuning or model-conversion job: pull a checkpoint from the Hub, re-save the tokenizer into a shared cache or model registry. Where those jobs run as root in a container, or write into an NFS/object-backed model store shared with other tenants, the write lands somewhere later code executes from - a startup script, a conda site-packages file, a served model directory. Processors inheriting from ProcessorMixin are affected broadly, including Idefics, Florence, Gemma, Phi and Qwen-VL.

Who can reach it

No access to the cluster is needed. The attacker publishes a model repository; a user or an automated pipeline on the fleet must download it and call save_pretrained() on the tokenizer or processor (CVSS records this as user interaction required). Exposure is proportional to how freely jobs pull from untrusted Hub namespaces.

What to do

Upgrade transformers past the fix in commit eaaaf84 and rebuild the training/serving images that pin it, then restart the jobs and inference processes using them; the record names affected versions as <= 5.8.0.dev0 but does not state a released fixed version, so check the project release notes before pinning. Until images are rebuilt, restrict which Hub namespaces jobs may pull from, and avoid running save_pretrained() as root or into shared model stores. No node reboot or firmware work is involved.

References

Related entries

• MLflow (`spark_udf` dir perms): Excessive directory permissionsCVE-2024-27134 · MLflow (`spark_udf` dir perms)High
• NVIDIA NemoClaw: code injection in the migration command gives a local user execution as the tool's privilegesCVE-2026-65082 · NVIDIA NemoClaw for Linux (migration command)High
• llama.cpp ggml RPC server: unvalidated tensor op and op_params in deserialize_tensorCVE-2026-78147 · llama.cpp ggml RPC server (deserialize_tensor op / op_params validation)Medium
• llama.cpp ggml RPC server: null pointer dereference in graph_compute kills the GPU workerCVE-2026-78148 · llama.cpp ggml RPC server (rpc_server::graph_compute)Medium
• BentoML: SSRF filter misses 100.64.0.0/10, so serving pods fetch from internal CGNAT hostsCVE-2026-78205 · BentoML make_safe_connect (SSRF address filter, RFC 6598 range)Medium
• vLLM: DeepStream backend misclassification skips pixel limits and lets unauthenticated video exhaust GPU decodeCVE-2026-78684 · vLLM (DeepStream GPU decode path, pixel-limit enforcement)Medium