CVE-2026-9856: Transformers Path Traversal Vulnerability Allows Arbitrary File Writes
Summary
CVE-2026-9856: Transformers save_pretrained path traversal allows arbitrary file writes through chat template names. Affects transformers versions < 5.10.0. Fixed in 5.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'transformers' package, developed by Hugging Face, is a popular library used for natural language processing tasks. It provides pre-trained models and tools for various applications, including text generation and understanding. The library's functionality is built around the concept of transformers, which are deep learning models that excel in processing sequential data. However, a critical vulnerability has been identified in versions prior to 5.10.0, which exposes users to potential security risks due to improper handling of file paths.
Vulnerability Detail
A vulnerability in huggingface/transformers versions < 5.10.0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the save_pretrained() methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chat_template dictionary are used directly as filenames without proper validation. An attacker can exploit this by publishing a malicious Hugging Face Hub repository with a crafted tokenizer_config.json file. When a victim downloads and saves the tokenizer or processor, the attacker-controlled keys can escape the intended save directory, enabling arbitrary file writes with attacker-controlled content. This vulnerability affects multiple processors inheriting from ProcessorMixin, including Idefics, Florence, Gemma, Phi, and Qwen-VL.
How To Fix
Latest published version: 5.20.2 as of 22 Oct 2026
pip install --upgrade "transformers==5.20.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.10.0
This is the first release that contains the fix.
pip install --upgrade "transformers==5.10.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using untrusted or malicious Hugging Face Hub repositories for downloading tokenizers or processors. Always verify the source and content of the tokenizer_config.json file before using it.
Conclusion
The CVE-2026-9856 vulnerability in the 'transformers' package poses significant security risks due to its ability to allow arbitrary file writes through path traversal. Users are strongly advised to update to version 5.10.0 or later to mitigate this risk. Additionally, exercising caution when downloading resources from external repositories is crucial.
See every vulnerability recorded for transformers →
FAQ
CVE-2026-9856 is a security vulnerability in the 'transformers' package that allows arbitrary file writes due to improper path handling.
Versions of the 'transformers' package prior to 5.10.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package immediately, avoid using untrusted repositories and verify the integrity of any downloaded files.
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for transformers.
