Description
Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling file disclosure and filesystem reconnaissance.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
huggingface transformers
Default version status: unaffected
0 to ≤ 5.15.0affected
pkg:pypi/transformersReferences
- https://github.com/huggingface/transformers/issues/47176 ↗
- https://github.com/huggingface/transformers/issues/47177 ↗
- https://github.com/huggingface/transformers ↗
- https://github.com/huggingface/transformers/blob/main/src/transformers/utils/hub.py ↗
- https://www.vulncheck.com/advisories/hugging-face-transformers-path-traversal-via-checkpoint-index ↗