Description

Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in load_checkpoint_in_model and load_checkpoint_and_dispatch functions that fail to sanitize weight_map entries from sharded checkpoint indexes. Attackers can supply relative paths with ../ sequences or absolute paths to read arbitrary files, or point shard entries at named pipes to cause indefinite blocking and denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-10T20:17:31.853Z",
  "pubdate": "2026-08-10T20:17:31.853Z",
  "executiveSummary": "A path traversal vulnerability exists in Hugging Face Accelerate through 1.14.0 within the model loading and checkpoint dispatching mechanisms. The vulnerability arises due to the application's failure to properly sanitize weight_map entries derived from sharded checkpoint indexes.\nThis security flaw allows malicious actors to supply relative paths containing directory traversal sequences (such as ../) or absolute paths. Successful exploitation permits attackers to read arbitrary files accessible to the process execution context or induce a denial of service condition by pointing shard entries at named pipes, which results in indefinite blocking.\nThe affected products include Hugging Face Accelerate versions up to 1.14.0. The primary impacted functions are load_checkpoint_in_model and load_checkpoint_and_dispatch. Risk implications are severe, as unauthorized file read operations can lead to the exposure of sensitive system data, and resource exhaustion can disrupt critical availability.\nAttacker capabilities require the ability to supply or modify a sharded checkpoint index containing malicious weight_map values. The exploitation vector leverages the parsing of untrusted checkpoint indexes during standard model initialization workflows.",
  "technicalDetails": "The root cause of the vulnerability resides in the insufficient sanitization and validation of input strings within the weight_map dictionary of sharded checkpoint indexes. Specifically, the load_checkpoint_in_model and load_checkpoint_and_dispatch functions process checkpoint mapping entries without adequately verifying that the target shard paths remain within the designated base directory.\nThe vulnerable component consists of the checkpoint loading and model dispatch subsystems in Hugging Face Accelerate through 1.14.0. Because the application blindly trusts the path values specified in the weight_map, an attacker can manipulate these entries to reference locations outside the intended storage boundary.\nThe exploitation method involves crafting a malicious checkpoint index file where the weight_map maps tensor names to arbitrary file paths. These paths can utilize directory traversal sequences like ../ to navigate upward in the filesystem hierarchy or specify absolute paths directly.\nThe step-by-step attack flow proceeds as follows: First, the attacker prepares a malicious sharded checkpoint index containing path entries with relative traversal sequences or absolute paths pointing to targeted system files or named pipes. Second, the victim or automated system invokes load_checkpoint_in_model or load_checkpoint_and_dispatch using this malicious index. Third, the vulnerable functions process the unsanitized weight_map entries. For arbitrary file read scenarios, the application attempts to open and read the referenced file, potentially leaking sensitive data into model memory or logs. For denial of service scenarios, pointing the shard entry to a named pipe causes the synchronous loading process to block indefinitely waiting for input, hanging the execution thread.\nAuthentication and privilege requirements depend on the execution context of the application consuming the untrusted checkpoint index, requiring only standard file read permissions for the running process. The network exposure is indirect, typically triggered when users load checkpoints obtained from untrusted sources such as public repositories or shared storage."
}