CVE-2026-69112

A flaw was found in Hugging Face Accelerate. This path traversal vulnerability exists in the loadcheckpointinmodel and loadcheckpointanddispatch functions due to a failure to sanitize weightmap entries from sharded checkpoint indexes. An attacker can exploit this by supplying relative paths with...

Directory Traversal

Overview accelerate is an Accelerate Affected versions of this package are vulnerable to Directory Traversal via loadcheckpointinmodel and loadcheckpointanddispatch through sharded-checkpoint weightmap handling in src/accelerate/utils/modeling.py. An attacker can make the loader read arbitrary...

CVE-2026-69112 Hugging Face Accelerate 1.14.0 Path Traversal and DoS via weight_map

Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in loadcheckpointinmodel and loadcheckpointanddispatch functions that fail to sanitize weightmap entries from sharded checkpoint indexes. Attackers can supply relative paths with ../ sequences or absolute paths to read...

CVE-2026-69112

Hugging Face Accelerate

CVE-2026-69112: Improper Limitation of a Pathname to a Restricted Directory

Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in loadcheckpointinmodel and loadcheckpointanddispatch functions that fail to sanitize weightmap entries from sharded checkpoint indexes. Attackers can supply relative paths with ../ sequences or absolute paths to read...