Hugging Face Transformers — Path Traversal via chat_template Keys Enables Arbitrary File Write in save_pretrained()

Published August 2, 2026 (CVSS 7.1/High, huntr.dev-assigned). A path-traversal flaw in the widely-used Transformers library's tokenizer/processor serialization code allows arbitrary file writes when saving a maliciously crafted chat_template, e.g. sourced from an untrusted Hugging Face Hub model repo.

Transformers is one of the most widely deployed ML libraries; loading community/third-party tokenizer configs (a routine workflow when pulling models from the Hub) and calling save_pretrained() could let an attacker-supplied model repo silently write or overwrite files anywhere the calling process has permissions — a supply-chain-style risk for any pipeline that programmatically re-saves models/tokenizers.

Keys from an attacker-controlled `chat_template` dictionary are used directly to construct filesystem paths during `save_pretrained()` without sanitization, allowing path traversal sequences (e.g. `../../`) to write arbitrary files outside the intended output directory when a malicious tokenizer/processor config is loaded and re-saved.

huggingface/transformers <= 5.8.0.dev0 (PreTrainedTokenizerBase and ProcessorMixin save_pretrained() methods)

Update to the patched transformers release referencing commit eaaaf8494dd5386634ae37d1d122212fdc315be5; sanitize/allowlist chat_template keys before using them in path construction; avoid loading and re-saving tokenizer configs from untrusted sources.