What happened
NVD published CVE-2026-9856 (CVSS 7.1) on 2026-08-02, describing a path traversal vulnerability in Hugging Face Transformers' tokenizer/processor serialization code where untrusted chat_template dictionary keys are used unsanitized as filesystem path components during save_pretrained() calls.
Why it matters
Transformers is one of the most widely deployed ML libraries in the world; any pipeline that saves a tokenizer/processor configured from an untrusted or user-supplied chat template (e.g., loading community models/configs) could allow an attacker to write files to arbitrary locations on the host, a serious risk for any AI training or fine-tuning infrastructure.
Attack vector
The save_pretrained() methods of PreTrainedTokenizerBase and ProcessorMixin use keys from an attacker-influenced chat_template dictionary directly to build filesystem paths without sanitization, allowing arbitrary file writes outside the intended save directory when saving a tokenizer/processor configured with a malicious chat template.
Affected systems
huggingface/transformers <= 5.8.0.dev0
Mitigation
Update to the patched transformers release; the fix is in commit eaaaf8494dd5386634ae37d1d122212fdc315be5. Avoid loading/saving tokenizers or processors with chat_template dictionaries from untrusted sources.