CVE-2026-9856: Hugging Face Transformers path traversal in save_pretrained

CVE-2026-9856 · Severity: high · CVSS 7.1 · Published 2026-08-02

Hugging Face Transformers is a popular library for downloading and working with machine learning models. A flaw in versions before 5.10.0 allows an attacker to write files outside the intended directory on a victim's machine when they save a tokenizer or processor downloaded from a malicious Hugging Face Hub repository. This could lead to code execution, configuration tampering, or overwriting critical system files, depending on where the library is being run and what permissions it has.

Technologies: Hugging Face Transformers, transformers (PyPI). Vendors: Hugging Face, PyPI.

Quick answers

Is CVE-2026-9856 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-9856 being exploited in the wild.
How severe is CVE-2026-9856?
High severity, with a CVSS score of 7.1, published 2 August 2026.
Which products and versions are affected?
Hugging Face Transformers < 5.10.0; transformers (PyPI) ECOSYSTEM:introduced=0,fixed=5.10.0.
Is there a fix for CVE-2026-9856?
Yes. transformers (PyPI): upgrade to 5.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9856 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-9856?
Check whether you run Hugging Face Transformers or transformers (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • transformers (PyPI): upgrade to 5.10.0 or later
    pip install "transformers>=5.10.0"

Technical details

The vulnerability is a classic path traversal (CWE-22) flaw in the save_pretrained() methods of PreTrainedTokenizerBase and ProcessorMixin. The vulnerable code constructs output file paths using chat template dictionary keys directly without validation, allowing path traversal sequences (e.g., "../../foo") to escape the chat_template_dir. An attacker publishes a malicious repository with a crafted tokenizer_config.json containing legacy list-of-dicts chat template format where the "name" field includes directory traversal sequences. When a victim calls save_pretrained() on the downloaded model, these names flow directly into os.path.join() calls, enabling arbitrary file writes with attacker-controlled content outside the target save directory. The attack requires network access and user interaction (downloading and saving the model), but no authentication or privileges. The fix, released in version 5.10.0, validates template names to ensure their resolved paths remain within chat_template_dir before writing files.

Affected products

  • Hugging Face Transformers < 5.10.0

Identifiers

  • CVE-2026-9856
  • GHSA-xrqw-3rrv-vx5w
  • PYSEC-2026-3929

Timeline

  • 2026-08-02: disclosed: Vulnerability disclosed to GitHub Advisory Database
  • 2026-09-01: advisory: GitHub security review completed
  • 2026-05-25: patched: Fix merged in commit eaaaf84 for version 5.10.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.