Summary
A path traversal vulnerability in Hugging Face Transformers allows attacker-controlled keys from chat_template to be used as filenames during save_pretrained() operations.
If a user downloads a malicious tokenizer or processor, these filenames can escape the intended directory and overwrite arbitrary files on the victim's system.
Affected context
This vulnerability appears when applications use huggingface/transformers (versions <= 5.8.0.dev0) to load and then persist tokenizers or processors from external repositories, especially the Hugging Face Hub.
It is relevant to code paths that:
- Call
save_pretrained()onPreTrainedTokenizerBaseorProcessorMixininstances - Accept
tokenizer_config.jsonand related configuration from third-party or untrusted model repositories - Do not enforce strict constraints on where auxiliary files can be written
Multiple processor implementations inheriting from ProcessorMixin (including Idefics, Florence, Gemma, Phi, and Qwen-VL) are affected when their configuration includes attacker-controlled chat_template keys.
Exploit preconditions
- Attack surface: Model and tokenizer loading workflows that consume remote configuration (e.g., from Hugging Face Hub).
- Required access: Ability to publish or influence a repository that the victim's environment loads, or control the
tokenizer_config.jsonfile content. - Trigger point: Invocation of
save_pretrained()on a tokenizer or processor that has achat_templatedictionary with malicious keys. - Why exploitation is possible: Filenames are derived directly from
chat_templatekeys without path sanitization or restriction, allowing../or absolute paths to escape the target directory and write files to arbitrary locations within the process' write-access scope.
Why this happens
The underlying bug is a classic path traversal issue where user-controlled input is treated as a trusted filesystem path.
In Transformers, the save_pretrained() methods for PreTrainedTokenizerBase and ProcessorMixin construct output filenames directly from keys in the chat_template dictionary without normalizing, validating, or restricting them to a safe subset.
This maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, because the intended constraint—keeping all artifacts inside a designated save directory—is bypassed by unsanitized relative or absolute paths.
Potential impact
- Arbitrary file creation or overwrite within directories writable by the application
- Modification of configuration files, environment settings, or application data that may affect future runs
- Planting or altering scripts and auxiliary files that could later be executed by other tools in the environment
- Corruption of model-related assets, leading to integrity loss and potentially data leakage or denial of service
General mitigation guidance
Effective mitigation focuses on reducing trust in configuration-derived paths and enforcing strict filesystem boundaries.
Common defensive patterns include:
- Normalizing and validating all filenames derived from configuration or templates, rejecting path separators,
.., or absolute paths - Confining writes to an explicitly defined directory and enforcing checks that prevent escaping this root (e.g., by verifying resolved paths are under the target base directory)
- Treating Hub and third-party model configuration as untrusted input and limiting what fields can influence filesystem behavior
- Running code that processes external models with least privileges, ensuring the process can only write to controlled, non-sensitive locations
How teams detect issues like this
Teams can detect similar issues by:
- Using static analysis rules that flag direct use of user-controlled strings as filesystem paths, especially in save or write operations
- Reviewing code for patterns where configuration dictionaries, templates, or JSON keys are interpolated into filenames without sanitization
- Establishing secure coding policies that require path normalization and directory confinement checks before file writes
- Integrating automated code review or application security testing tools that understand path traversal patterns and can highlight unsafe uses of functions like
open(),save_pretrained(), and related APIs
