Executive brief
Hugging Face Transformers is a popular library for downloading and working with machine learning models. A flaw in versions before 5.10.0 allows an attacker to write files outside the intended directory on a victim's machine when they save a tokenizer or processor downloaded from a malicious Hugging Face Hub repository. This could lead to code execution, configuration tampering, or overwriting critical system files, depending on where the library is being run and what permissions it has.
Technical details
The vulnerability is a classic path traversal (CWE-22) flaw in the save_pretrained() methods of PreTrainedTokenizerBase and ProcessorMixin. The vulnerable code constructs output file paths using chat template dictionary keys directly without validation, allowing path traversal sequences (e.g., "../../foo") to escape the chat_template_dir. An attacker publishes a malicious repository with a crafted tokenizer_config.json containing legacy list-of-dicts chat template format where the "name" field includes directory traversal sequences. When a victim calls save_pretrained() on the downloaded model, these names flow directly into os.path.join() calls, enabling arbitrary file writes with attacker-controlled content outside the target save directory. The attack requires network access and user interaction (downloading and saving the model), but no authentication or privileges. The fix, released in version 5.10.0, validates template names to ensure their resolved paths remain within chat_template_dir before writing files.
Affected products
- Hugging Face Transformers < 5.10.0
Timeline
- 2026-08-02: disclosed: Vulnerability disclosed to GitHub Advisory Database
- 2026-09-01: advisory: GitHub security review completed
- 2026-05-25: patched: Fix merged in commit eaaaf84 for version 5.10.0