The flaw is a path traversal vulnerability located in the load_checkpoint_in_model and load_checkpoint_and_dispatch functions of Hugging Face Accelerate. The implementation fails to sanitize weight_map entries that come from sharded checkpoint indexes, allowing callers to insert relative paths containing "../" sequences or absolute paths. This omission enables an attacker to read arbitrary files on the host system. In addition, the vulnerability permits weight_map entries to point at named pipes, leading to indefinite blocking and thus denial of service for the process that loads the checkpoint.

All releases of Hugging Face Accelerate up to and including version 1.14.0 are affected. This includes any deployments that load checkpoints using the identified functions from these versions.

The CVSS score of 6.9 indicates moderate to high severity, while the EPSS score is not published and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker who can supply a malicious checkpoint or weight_map payload to the application, which then triggers the unchecked path resolution. If the application runs with sufficient file system privileges, the attacker can read sensitive files and, by abusing named pipes, cause service interruption. The absence of a published EPSS score does not diminish the risk for environments that import checkpoints from untrusted sources or run train jobs as higher‐privileged users.