CVE-2026-9856

What it actually does

Path traversal in save_pretrained() of PreTrainedTokenizerBase and ProcessorMixin allows untrusted chat_template dictionary keys to be used directly as filenames, enabling writes of attacker-controlled content outside the intended directory.

Why it matters to the business

Attackers can overwrite arbitrary files on systems that download and save models from the Hugging Face Hub, leading to potential data corruption, service disruption, or further system compromise in AI/ML pipelines.

How an attack unfolds

An attacker publishes a malicious repository on the Hugging Face Hub containing a crafted tokenizer_config.json with path-traversal keys inside the chat_template dictionary; when a victim downloads the tokenizer or processor and invokes save_pretrained(), the unsanitized keys cause arbitrary file writes with attacker-supplied content.

How to fix it

Upgrade the transformers library to a version containing input validation for chat_template keys; until a fix is released, avoid calling save_pretrained() on objects loaded from untrusted repositories and implement strict filename sanitization in any custom wrappers.

How to confirm the fix worked

Confirm the installed transformers version is newer than 5.8.0.dev0; test save_pretrained() behavior with a crafted tokenizer_config.json containing traversal sequences such as '../' and verify that writes remain confined to the target directory.

Typical attack path

1. Create and publish malicious repository on Hugging Face Hub with crafted tokenizer_config.json
2. Victim downloads and loads the tokenizer or processor via the Hub
3. Victim calls save_pretrained() on the loaded object
4. Path traversal writes attacker-controlled files to arbitrary locations on disk

How to detect it

Review application and system logs for save_pretrained() invocations that reference tokenizer_config.json or chat_template entries; correlate with file-system audit logs showing writes containing traversal sequences or unexpected file extensions outside the model cache directory.

What your security team should do

• Pin transformers to a patched release as soon as it becomes available
• Restrict model downloads to verified organizations or repositories with signed commits
• Run model-loading workloads inside containers with read-only root filesystems and limited write paths
• Add runtime monitoring for unexpected file writes originating from save_pretrained() calls