CVE-2026-9856 Path Traversal in huggingface/transformers
Attackers can write arbitrary files via path traversal in save_pretrained methods when processing malicious tokenizer configs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-9856?
CVE-2026-9856 is a high-severity path traversal vulnerability in huggingface/transformers, published on 2 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the `save_pretrained()` methods of `PreTrainedTokenizerBase` and `ProcessorMixin`, where keys from the `chat_template` dictionary are used directly as filenames without proper validation. An attacker can exploit this by publishing a malicious Hugging Face Hub repository with a crafted `tokenizer_config.json` file. When a victim downloads and saves the tokenizer or processor, the attacker-controlled keys can escape the intended save directory, enabling arbitrary file writes with attacker-controlled content. This vulnerability affects multiple processors inheriting from `ProcessorMixin`, including Idefics, Florence, Gemma, Phi, and Qwen-VL.
Weakness: CWE-22
Which versions are affected by CVE-2026-9856?
3 open source packages ship an affected version, including transformers.
| Package | Affected | Fixed in |
|---|---|---|
transformers PyPI | All versions | 5.10.0 |
transformers PyPI | All versions | 5.10.0 |
transformers PyPI | All versions | 5.10.0 |
How do I fix CVE-2026-9856?
Upgrade transformers to 5.10.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-9856 being exploited?
There is no known exploitation of CVE-2026-9856 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1788512070, ECHO-230d-a6b3-d275, GHSA-xrqw-3rrv-vx5w, MINI-c5x3-wmfp-xrp6, MINI-h559-7p2f-hm8g, MINI-hr3g-w8w2-xrp2 and 2 more.