CVE-2026-9856 huggingface CVE debrief

Who should care

Organizations using huggingface/transformers versions <=5.8.0.dev0, particularly those with high-risk applications or sensitive data, should prioritize patching this vulnerability due to its high CVSS score of 7.1 and potential impact. This includes operators of affected systems, platform administrators, vulnerability management teams, and security teams responsible for ensuring the security and integrity of their systems and data. Immediate attention is required to prevent potential exploitation and minimize the risk of arbitrary file writes with attacker-controlled content.

Technical summary

The vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the `save_pretrained()` methods of `PreTrainedTokenizerBase` and `ProcessorMixin`, where keys from the `chat_template` dictionary are used directly as filenames without proper validation. This can be exploited by publishing a malicious Hugging Face Hub repository with a crafted `tokenizer_config.json` file. When a victim downloads and saves the tokenizer or processor, the attacker-controlled keys can escape the intended save directory, enabling arbitrary file writes with attacker-controlled content. Multiple processors are affected, including Idefics, Florence, Gemma, Phi, and Qwen-VL. Organizations should prioritize patching due to the high CVSS score and potential for arbitrary file writes.

Defensive priority

Organizations using huggingface/transformers versions <=5.8.0.dev0 should prioritize patching due to the high CVSS score of 7.1 and potential for arbitrary file writes.

Recommended defensive actions

• Inventory and check usage of huggingface/transformers versions <=5.8.0.dev0
• Apply patches or upgrade to a version >5.8.0.dev0
• Monitor for suspicious activity related to file writes
• Implement compensating controls, such as restricting write access to sensitive directories
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability allows an attacker to perform arbitrary file writes via path traversal in huggingface/transformers versions <=5.8.0.dev0. The issue resides in the `save_pretrained()` methods of `PreTrainedTokenizerBase` and `ProcessorMixin`. Evidence is based on limited source detail, with official CVE and NVD records, and two source references from Huntr.

Official resources