CVE-2026-75104: Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitr

Hugging Face Transformers has a vulnerability where it doesn't properly check filenames in checkpoint index files (configuration files that list model components), allowing attackers to read files outside the intended model directory. An attacker can create a malicious index file with path traversal (references like '../' that escape the intended folder) or absolute paths that the software processes without validation, leading to unauthorized file access and system reconnaissance.