← News
/DISPATCH · 2026-08-16

CVE-2026-9856: HuggingFace Transformers Path Traversal Hits Idefics/Florence/Gemma/Phi/Qwen-VL — Local Model Save Overwrites Arbitrary Files

CVE-2026-9856, disclosed 2026-08-02, hits HuggingFace Transformers <=5.8.0.dev0. Attacker publishes a Hub repo with a malicious tokenizer_config.json; victim save_pretrained() triggers path traversal and arbitrary file write. CVSS 7.1. Public PoC repo in the wild.

Incident Overview

On 2026-08-02 MITRE and NVD simultaneously listed CVE-2026-9856, reported by Protect AI (formerly huntr.dev), namespace huggingface/transformers. HuggingFace Transformers is a de facto standard for LLM fine-tuning and inference. The bug lives in save_pretrained(); local save of pretrained models and processors can overwrite arbitrary files. Fixed in 5.10.0. A public PoC repo landed on GitHub within three days. rdintel and Sonatype marked it Actively exploited.

Technical Details

Root cause: CWE-22 path traversal. Trigger: save_pretrained() in PreTrainedTokenizerBase and ProcessorMixin. Both serialize the chat_template dict from tokenizer_config.json by treating dict keys as filenames concatenated into the save directory. No path-separator normalization. No `../` check. Attacker plants a crafted tokenizer_config.json on a HuggingFace Hub repo, setting a chat_template key to a relative path such as ../../malicious. Victim pulls the repo and runs processor.save_pretrained() or tokenizer.save_pretrained(); values write anywhere the runtime account can write. Affected ProcessorMixin subclasses include at least Idefics, Florence, Gemma, Phi, and Qwen-VL. Fix landed in 5.10.0 at commit eaaaf8494dd5386634ae37d1d122212fdc315be5.

Impact

NVD base score CVSS 3.0 7.1 (High), vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L. Network-reachable, user interaction required. EPSS currently 0.295%. Realistic scenarios: researcher/engineer blindly pulls a CSDN/GitHub/HuggingFace tutorial repo and saves the model — ~/.bashrc gets miner commands, a NAS .env is rewritten leaking API keys, CI sandbox ~/.ssh/authorized_keys is planted with a persistent SSH key that lands in the build cache. Sonatype and rdintel both report a public PoC repo. Template scanners and SIEM rules exist. Mature exploit window: easy to copy, no auth.

Remediation

AI/ML Team Practice Upgrade

This bug exposes a long-ignored supply-chain surface: locally saving a model/tokenizer is a high-privilege filesystem write. Community attention has focused on pytorch_model.bin deserialization and pickle poisoning; save_pretrained() write-path checks were essentially empty. LLM teams should fold transformers upgrades and Hub access governance into MLOps: signed verification of external Hub repos on the internal Model Registry; access tokens plus download audit on private repos; split signatures on weights vs config (weight hash, config hash, and signature checked separately); filesystem-state diff before and after save_pretrained. rdintel's PoC repo (researcher/exploit-poc) is cited by a GitHub Security Advisory. Pull it into the internal red-team repro library and verify detection rules cover tokenizer_config.json keys containing `../`.

Impact on China's Open-Source LLM Ecosystem

Chinese/Chinese-enhanced builds of Qwen-VL, Gemma, and Phi generally load through HuggingFace Transformers. Qwen-VL is explicitly on the affected list. Teams doing local fine-tune or inference on domestic open-source models should upgrade transformers to 5.10.0 immediately and check whether ModelScope, Wisemodel, and OpenCSG mirrors have pushed the fixed version. Also: when wiring tokenizer/processor download into CI, mount the save_pretrained write directory on a one-shot tmpfs so the build cache is not polluted. For MaaS APIs, restrict user-uploaded model save_pretrained calls to a read-only sandbox so malicious config never reaches the server filesystem.

References