Описание
A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the save_pretrained() methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chat_template dictionary are used directly as filenames without proper validation. An attacker can exploit this by publishing a malicious Hugging Face Hub repository with a crafted tokenizer_config.json file. When a victim downloads and saves the tokenizer or processor, the attacker-controlled keys can escape the intended save directory, enabling arbitrary file writes with attacker-controlled content. This vulnerability affects multiple processors inheriting from ProcessorMixin, including Idefics, Florence, Gemma, Phi, and Qwen-VL.
A flaw was found in Hugging Face Transformers. An attacker can exploit a path traversal vulnerability in the save_pretrained() methods of PreTrainedTokenizerBase and ProcessorMixin by publishing a malicious Hugging Face Hub repository. When a victim downloads and saves a tokenizer or processor, attacker-controlled keys in the chat_template dictionary can lead to arbitrary file writes outside the intended save directory. This could allow an attacker to write malicious files to arbitrary locations on a user's system.
Отчет
This vulnerability is rated as Important severity because successful exploitation allows path traversal leading to arbitrary file modification with the privileges of the executing process, potentially enabling code execution. Although exploitation requires user interaction to download and serialize an untrusted repository, the high integrity impact of unrestricted filesystem writes elevates the risk above Moderate. In typical Red Hat deployments such as AI/ML pipelines and model-serving environments, exposure occurs when applications ingest and save untrusted community models. Workloads running in isolated containers or under restricted service accounts limit the blast radius of any resulting directory escape.
Дополнительная информация
Статус:
EPSS
8.1 High
CVSS3
Связанные уязвимости
A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the `save_pretrained()` methods of `PreTrainedTokenizerBase` and `ProcessorMixin`, where keys from the `chat_template` dictionary are used directly as filenames without proper validation. An attacker can exploit this by publishing a malicious Hugging Face Hub repository with a crafted `tokenizer_config.json` file. When a victim downloads and saves the tokenizer or processor, the attacker-controlled keys can escape the intended save directory, enabling arbitrary file writes with attacker-controlled content. This vulnerability affects multiple processors inheriting from `ProcessorMixin`, including Idefics, Florence, Gemma, Phi, and Qwen-VL.
Transformers save_pretrained path traversal allows arbitrary file writes through chat template names
EPSS
8.1 High
CVSS3