CVE-2026-9856: A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes vi

A vulnerability in Hugging Face Transformers (a library for working with AI models) versions 5.8.0 and earlier allows attackers to write files anywhere on a user's computer through path traversal (a technique where an attacker uses special characters like '../' to escape the intended directory). The flaw exists in the `save_pretrained()` methods, which don't properly validate dictionary keys before using them as filenames, allowing attackers to distribute malicious model configuration files that execute arbitrary writes when downloaded and saved by victims.