Technical impact
A path traversal flaw in the `save_pretrained()` methods of PreTrainedTokenizerBase and ProcessorMixin allows an attacker to write arbitrary files with attacker‑controlled content. The flaw arises because keys from the chat_template dictionary are used directly as filenames without validation, which satisfies the criteria of CWE‑22. An exploit would let the attacker overwrite or create files outside the intended directory, potentially compromising system integrity or installing malicious payloads.
Affected Systems
The vulnerability affects the huggingface/transformers library in versions up to and including 5.8.0.dev0. Any processor that inherits from ProcessorMixin—such as Idefics, Florence, Gemma, Phi, and Qwen‑VL—is also impacted.
Risk and Exploitability
The CVSS score of 7.1 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV, suggesting no current widespread exploitation reports. The likely attack vector involves an attacker publishing a malicious repository on the Hugging Face Hub with a crafted tokenizer_config.json. A victim who downloads and saves the tokenizer or processor will trigger the vulnerable code and be able to write files arbitrarily through the exposed path traversal. The exploit requires the victim to interpolate the injected keys during the save operation, which typically occurs when standard library routines are called without additional defensive checks.
Github GHSA