6 matches found
CVE-2026-75104
A flaw was found in Hugging Face Transformers. Attackers can exploit this by supplying malicious checkpoint index files with parent-directory references or absolute paths that are not properly validated. This vulnerability allows for reading arbitrary files outside the model directory, leading to...
CVE-2026-75104
Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling...
CVE-2026-75104 Hugging Face Transformers Path Traversal via Checkpoint Index
Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling...
CVE-2026-75104
Hugging Face Transformers joins shard filenames from checkpoint index files without validation, allowing malicious index files with parent-directory references or absolute paths to read arbitrary files outside the model directory. CVSS 6.8 (medium) requires local access and user interaction. No p...
CVE-2026-75104 Hugging Face Transformers Path Traversal via Checkpoint Index
Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling...
EUVD-2026-60384
Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling...