Hugging Face Transformers: path traversal in save_pretrained() writes files outside the save directory

Impact

Keys of the chat_template dictionary in tokenizer_config.json are used directly as filenames when a tokenizer or processor is re-saved, with no validation. A model repository on the Hub can therefore carry a crafted config whose keys traverse out of the intended output directory, so that any pipeline which downloads that repo and calls save_pretrained() writes attacker-controlled content to an attacker-chosen path with the privileges of the job. On a GPU fleet this is the normal shape of a fine-tuning or model-conversion job: pull a checkpoint from the Hub, re-save the tokenizer into a shared cache or model registry. Where those jobs run as root in a container, or write into an NFS/object-backed model store shared with other tenants, the write lands somewhere later code executes from - a startup script, a conda site-packages file, a served model directory. Processors inheriting from ProcessorMixin are affected broadly, including Idefics, Florence, Gemma, Phi and Qwen-VL.

Who can reach it

No access to the cluster is needed. The attacker publishes a model repository; a user or an automated pipeline on the fleet must download it and call save_pretrained() on the tokenizer or processor (CVSS records this as user interaction required). Exposure is proportional to how freely jobs pull from untrusted Hub namespaces.

What to do

Upgrade transformers past the fix in commit eaaaf84 and rebuild the training/serving images that pin it, then restart the jobs and inference processes using them; the record names affected versions as <= 5.8.0.dev0 but does not state a released fixed version, so check the project release notes before pinning. Until images are rebuilt, restrict which Hub namespaces jobs may pull from, and avoid running save_pretrained() as root or into shared model stores. No node reboot or firmware work is involved.

References

Related entries

• MLflow (`spark_udf` dir perms): Excessive directory permissionsCVE-2024-27134 · MLflow (`spark_udf` dir perms)High
• NVIDIA NemoClaw: code injection in the migration command gives a local user execution as the tool's privilegesCVE-2026-65082 · NVIDIA NemoClaw for Linux (migration command)High
• vLLM: unbounded cache_salt stalls the EngineCore scheduler thread, denying service to all requestsCVE-2026-100647 · vLLM (OpenAI- and Anthropic-compatible API server, cache_salt handling)Medium
• vLLM: audio clip size limit not enforced, letting unauthenticated clients exhaust node memory and CPUCVE-2026-100648 · vLLM (multimodal chat audio decoding, VLLM_MAX_AUDIO_CLIP_FILESIZE_MB)Medium
• Quarkus LangChain4j: unauthenticated CONNECT frames leak chat scopes until the JVM exitsCVE-2026-108748 · Quarkus LangChain4j chat-scopes WebSocket endpoint (/_chat/routes)Medium
• Crawl4AI: robots.txt fetch bypasses egress controls, giving blind SSRF to metadata endpointsCVE-2026-109239 · Crawl4AI (RobotsParser.can_fetch in the Docker server)Medium