CVE-2026-9856
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
Hugging Face Transformers up to version 5.8.0.dev0 has an arbitrary file write vulnerability via path traversal in save_pretrained(). Keys from chat_template are used as filenames without validation.
Risk Assessment
An attacker can publish a malicious repository that, when downloaded and saved by a victim, overwrites arbitrary files on the victim's system.
Recommendation
Upgrade the transformers library to a patched version or restrict trust in downloaded tokenizers.
Other vulnerabilities in Hugging Face Transformers
See all- CVE-2026-80047High
A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). The function fetches and caches a remote module file before performing the required trust_remote_code consent check, inverting the security model enforced by other code-loading paths. As a result, attacker-controlled Python code from custom_generate/generate.py is copied into the user's ~/.cache/huggingface/modules directory even if the user declines the trust prompt.
- CVE-2026-75104Medium
Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Malicious index files with parent-directory references or absolute paths can lead to file disclosure and filesystem reconnaissance.
- CVE-2025-14930High
Deserialization of untrusted data in Hugging Face Transformers for the GLM4 model when parsing weights. Lack of validation of user-supplied data can lead to deserialization of untrusted data and remote code execution.
- CVE-2025-14929High
A vulnerability in Hugging Face Transformers' X-CLIP checkpoint conversion involves deserialization of untrusted data without proper validation. Exploitation requires user interaction (opening a malicious file or visiting a malicious page). It can lead to remote code execution in the context of the current process.
- CVE-2025-14928High
Code injection in the convert_config function of Hugging Face Transformers for the HuBERT model. Lack of validation of a user-supplied string before using it to execute Python code allows remote code execution.
- CVE-2025-14927High
Code injection in the convert_config function of Hugging Face Transformers for the SEW-D model. Lack of validation of a user-supplied string before using it to execute Python code allows remote code execution.
- CVE-2025-14926High
Code injection in the convert_config function of Hugging Face Transformers for the SEW model. Lack of validation of a user-supplied string before using it to execute Python code allows remote code execution.
- CVE-2025-14924High
Deserialization of untrusted data in Hugging Face Transformers for the megatron_gpt2 model when parsing checkpoints. Lack of validation of user-supplied data can lead to deserialization of untrusted data and remote code execution.
- CVE-2025-14921High
Deserialization of untrusted data in Hugging Face Transformers for the Transformer-XL model when parsing model files. Lack of validation of user-supplied data can lead to deserialization of untrusted data and remote code execution.
- CVE-2025-14920High
A vulnerability in Hugging Face Transformers' Perceiver model parsing involves deserialization of untrusted data without proper validation. Exploitation requires user interaction (opening a malicious file or visiting a malicious page). It can lead to remote code execution in the context of the current user.
Original NVD description (English source)
A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the `save_pretrained()` methods of `PreTrainedTokenizerBase` and `ProcessorMixin`, where keys from the `chat_template` dictionary are used directly as filenames without proper validation. An attacker can exploit this by publishing a malicious Hugging Face Hub repository with a crafted `tokenizer_config.json` file. When a victim downloads and saves the tokenizer or processor, the attacker-controlled keys can escape the intended save directory, enabling arbitrary file writes with attacker-controlled content. This vulnerability affects multiple processors inheriting from `ProcessorMixin`, including Idefics, Florence, Gemma, Phi, and Qwen-VL.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS