CVE-2026-69112 vulnerabilities

Vulnerabilities for packages: py3-accelerate-cuda-12.9, py3-accelerate-cuda-13.0, vllm-openai-cuda-12.9...

CVE-2026-69112

Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in loadcheckpointinmodel and loadcheckpointanddispatch functions that fail to sanitize weightmap entries from sharded checkpoint indexes. Attackers can supply relative paths with ../ sequences or absolute paths to read...