TI-2026-08625 Aliases CVE-2026-9856 GHSA-xrqw-3rrv-vx5w

Path Traversal in huggingface/transformers

LOW 32CWE-22Published 2026-08-02 · Updated 2026-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · Low
Fix status: Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA and GitHub.

Summary

A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the `save_pretrained()` methods of `PreTrainedTokenizerBase` and `ProcessorMixin`, where keys from the `chat_template` dictionary are used directly as filenames without proper validation. An attacker can exploit this by publishing a malicious Hugging Face Hub repository with a crafted `tokenizer_config.json` file. When a victim downloads and saves the tokenizer or processor, the attacker-controlled keys can escape the intended save directory, enabling arbitrary file writes with attacker-controlled content. This vulnerability affects multiple processors inheriting from `ProcessorMixin`, including Idefics, Florence, Gemma, Phi, and Qwen-VL.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0046 40th percentileScored 2026-11-07

Fix Fixed huggingface/transformers (huggingface): 5.10.0transformers (PyPI): 5.10.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
huggingface	huggingface/transformers	before 5.10.0	5.10.0	Patch available	CNA
—	transformers (PyPI)	before 5.10.0	5.10.0	Patch available	GHSA-xrqw-3rrv-vx5w

huggingface/transformers Vendorhuggingface Affected before 5.10.0 Fixed in 5.10.0 Patch available CNA
transformers (PyPI) Vendor— Affected before 5.10.0 Fixed in 5.10.0 Patch available GHSA-xrqw-3rrv-vx5w

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:huggingface:transformers::::::::	—	—	huggingface

cpe:2.3:a:huggingface:transformers:*:*:*:*:*:*:*:* Versions — — ·huggingface

Remediation

Fix · CNA huggingface/transformers (huggingface) Fixed in 5.10.0
Fix · GHSA-xrqw-3rrv-vx5w transformers (PyPI) Fixed in 5.10.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-9856
2026-10-03 Alias added: GHSA-xrqw-3rrv-vx5w
2026-11-06 Affected versions changed · Red Hat
2026-11-06 CVSS score added · Red Hat

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-9856

Other 4

TI-2026-48351 sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False CVSS 4.0CRITICAL 9.3
TI-2026-20914 LeRobot Unsafe Deserialization Remote Code Execution via gRPC CVSS 4.0CRITICAL 9.3
TI-2026-04577 Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers CVSS 3.1CRITICAL 9.6
TI-2025-04589 Sandbox Escape Vulnerability in huggingface/smolagents CVSS 3.1CRITICAL 10.0
TI-2026-79938 Pickle deserialization in Hugging Face Datasets allows code execution CVSS 4.0HIGH 8.7
TI-2026-32710 Diffusers: None.py Trust Remote Code Bypass CVSS 3.1HIGH 8.8

See all 58 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences