Answer in brief
CVE-2026-9856 records a High severity (CVSS 7.1) vulnerability in Transformers save_pretrained path traversal allows arbitrary file writes through chat template names. The current sources do not mark it as known exploited. The current feed maps transformers (pip), transformers (pypi). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps transformers (pip), transformers (pypi). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| transformerspip | <5.10.0 | 5.10.0 |
| transformerspypi | >=0 <5.10.0 | 5.10.0 |
Published upstream
Aug 2, 2026
Evidence: source:ghsa:source_dates:source-dates:recordSource modified
Sep 3, 2026
Evidence: source:ghsa:source_dates:source-dates:recordFirst seen by HOL
Aug 3, 2026
A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the `save_pretrained()` methods of `PreTrainedTokenizerBase` and `ProcessorMixin`, where keys from the `chat_template` dictionary are used directly as filenames without proper validation. An attacker can exploit this by publishing a malicious Hugging Face Hub repository with a crafted `tokenizer_config.json` file. When a victim downloads and saves the tokenizer or processor, the attacker-controlled keys can escape the intended save directory, enabling arbitrary file writes with attacker-controlled content. This vulnerability affects multiple processors inheriting from `ProcessorMixin`, including Idefics, Florence, Gemma, Phi, and Qwen-VL.
Quoted source text, attributed separately from HOL analysis.