Description

Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling file disclosure and filesystem reconnaissance.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-17T21:16:49.340Z",
  "pubdate": "2026-08-17T21:16:49.340Z",
  "executiveSummary": "The Hugging Face Transformers library contains a path traversal vulnerability stemming from inadequate validation of shard filenames within checkpoint index files. This flaw allows malicious actors to read arbitrary files residing outside the intended model directory.\nThe vulnerability directly impacts systems utilizing Hugging Face Transformers to load untrusted model checkpoints. Successful exploitation enables unauthorized file disclosure and facilitates filesystem reconnaissance, potentially exposing sensitive system files, configuration data, or credentials accessible to the process.\nTo exploit this vulnerability, an attacker must supply a specially crafted model checkpoint index file containing parent-directory path traversal sequences (such as directory traversal patterns) or absolute file paths. When the vulnerable component processes these inputs, it improperly joins the paths without validation, resulting in arbitrary file read operations.\nThe risk implications are significant for environments that automatically download and load models from untrusted sources, such as public repositories or third-party platforms, as execution of the parsing logic can lead to unauthorized data access without requiring advanced privileges.",
  "technicalDetails": "The root cause of the vulnerability lies in the insecure handling and lack of sanitization of shard filenames specified within checkpoint index files by Hugging Face Transformers. Specifically, when the library parses model checkpoint indices to locate and load constituent shards, it fails to validate or canonicalize the filenames provided in the index.\nWhen an index file containing malicious paths—such as relative traversal sequences (e.g., ../) or absolute paths—is processed, the underlying file-loading routines concatenate these untrusted strings directly with the base model directory path. Because no boundary checks are enforced prior to file access operations, the operating system resolves the traversal sequences, allowing the process to access files outside the intended security perimeter.\nThe step-by-step attack flow initiates when a victim or an automated pipeline obtains and loads a maliciously crafted model checkpoint containing a modified index file. The vulnerable component reads the index, extracts the malicious shard filenames, and constructs the target file path via unsafe concatenation. The application then attempts to read the targeted resource, successfully disclosing the contents of arbitrary files residing on the filesystem that the running process has permissions to read.\nThe affected component is the checkpoint index parsing and shard loading subsystem within Hugging Face Transformers. Exploitation requires the attacker to successfully supply or induce the target to load a malicious checkpoint index file. Authentication and privilege requirements depend on the context of the running application, but local file access is inherently bounded by the execution privileges of the process parsing the model."
}