CVE-2026-9856: huggingface/transformers path traversal in save_pretrained via chat_template

Summary

CVE-2026-9856 affects huggingface/transformers versions <=5.8.0.dev0 and allows arbitrary file writes via path traversal. Keys from the chat_template dictionary in the save_pretrained() methods of PreTrainedTokenizerBase and ProcessorMixin are used directly as filenames without validation, so a malicious Hub repository with a crafted tokenizer_config.json can write attacker-controlled content outside the save directory when a victim saves the tokenizer or processor. Multiple ProcessorMixin subclasses, including Idefics, Florence, Gemma, Phi, and Qwen-VL, are affected.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• transformersPyPILLM dependency since 2016-08-17 · 141 tracked dependents

Related items

• HighCVE-2026-119120: Crawl4AI Docker API lets clients choose the HuggingFace model it loadsSame vendor · NVD/CVE Database
• HighGHSA-wf6j-7hvr-gr93: Hydra legacy target blacklist permits unsafe PyYAML loadingSame vendor · Hugging Face Security Advisories
• MediumCVE-2026-100653: vLLM unpinned Hugging Face artifact loads for FunAudioChat and Tarsier2Same vendor · NVD/CVE Database
• HighGHSA-3hmm-rh5q-gwwr: LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loadingSame vendor · Hugging Face Security Advisories
• MediumCVE-2026-80047: Hugging Face Transformers writes remote Python files to disk before trust checkSame vendor · NVD/CVE Database