CVE-2026-9856

Name of the Vulnerable Software and Affected Versions huggingface/transformers versions prior to 5.8.0.dev0

Description An issue allows arbitrary file writes through path traversal, a technique used to access files and directories outside the intended folder. The flaw exists in the save pretrained() methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chat template dictionary are used as filenames without proper validation. An attacker can exploit this by publishing a malicious Hugging Face Hub repository containing a crafted tokenizer config.json file. When a user downloads and saves the tokenizer or processor, the attacker-controlled keys can escape the save directory to write arbitrary content. This affects several processors inheriting from ProcessorMixin, such as Idefics, Florence, Gemma, Phi, and Qwen-VL.

Recommendations Update to a version later than 5.8.0.dev0. As a temporary workaround, restrict the use of the save pretrained() function when handling tokenizers or processors from untrusted sources.