CVE-2026-9856 in transformers
Summary
by MITRE • 08/02/2026
A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the `save_pretrained()` methods of `PreTrainedTokenizerBase` and `ProcessorMixin`, where keys from the `chat_template` dictionary are used directly as filenames without proper validation. An attacker can exploit this by publishing a malicious Hugging Face Hub repository with a crafted `tokenizer_config.json` file. When a victim downloads and saves the tokenizer or processor, the attacker-controlled keys can escape the intended save directory, enabling arbitrary file writes with attacker-controlled content. This vulnerability affects multiple processors inheriting from `ProcessorMixin`, including Idefics, Florence, Gemma, Phi, and Qwen-VL.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/02/2026
This vulnerability represents a critical path traversal flaw in the huggingface/transformers library that enables remote attackers to execute arbitrary file write operations on systems running vulnerable versions. The issue stems from insufficient input validation within the save_pretrained() methods of PreTrainedTokenizerBase and ProcessorMixin classes, where dictionary keys extracted from chat_template configurations are directly utilized as filenames without proper sanitization or directory traversal checks. The vulnerability is particularly dangerous because it leverages the legitimate download and save functionality of machine learning models, making it difficult to distinguish between benign and malicious operations within normal workflow patterns.
The technical exploitation occurs through crafted malicious repositories hosted on the Hugging Face Hub platform, where attackers construct specially designed tokenizer_config.json files containing attacker-controlled keys in the chat_template dictionary. When victims download and subsequently save these tokenizers or processors using the vulnerable library versions, the system processes these keys directly as file paths without validating their contents against the intended save directory. This allows malicious keys to escape the designated storage location through directory traversal sequences such as ../ or ..\, enabling attackers to write files to arbitrary locations on the victim's filesystem with content controlled by the attacker.
The operational impact of this vulnerability extends across multiple processor types that inherit from ProcessorMixin, including but not limited to Idefics, Florence, Gemma, Phi, and Qwen-VL processors. This widespread affected scope increases the potential attack surface significantly, as these processors are commonly used in various machine learning applications and research environments. The vulnerability affects systems running versions up to and including 5.8.0.dev0 of the transformers library, making it particularly concerning for research institutions, development teams, and production environments that may be using outdated or experimental versions of the library.
Security implications of this vulnerability align with CWE-22 (Path Traversal) and can be mapped to ATT&CK technique T1059.001 (Command and Scripting Interpreter) through potential file execution scenarios that attackers might exploit after successful arbitrary writes. The vulnerability essentially allows attackers to inject malicious content into system directories, potentially leading to privilege escalation, persistence mechanisms, or data exfiltration attacks. Organizations should consider implementing network segmentation and access controls around systems that interact with external model repositories, as well as monitoring for unusual file creation patterns in model storage directories.
The recommended mitigations include immediate upgrading to patched versions of the huggingface/transformers library where proper input validation has been implemented for filename generation. Additionally, organizations should implement runtime restrictions on model download and save operations, particularly when dealing with externally sourced repositories. Security teams should establish monitoring procedures for detecting potentially malicious tokenizer configurations and consider implementing sandboxed environments for downloading and processing external machine learning models. The fix typically involves adding path validation routines that ensure all generated filenames remain within the intended directory boundaries, preventing directory traversal escapes through proper sanitization of user-controlled inputs.