CVE-2026-75104: Transformers path traversal

CISO Take

Hugging Face Transformers fails to validate shard filenames referenced in a model's checkpoint index file, letting a crafted index containing `../` sequences or absolute paths make the library read files outside the intended model directory. The risk model here is AI supply chain, not network-exposed: an attacker who publishes a poisoned model repository on the Hub, or convinces a developer to `from_pretrained()` a malicious checkpoint, can exfiltrate local secrets such as credentials, SSH keys, or environment config from the machine performing the load. CVSS 5.5 (AV:L/UI:R, confidentiality-only impact) and no EPSS score or CISA KEV listing reflect that this needs local, deliberate model loading rather than a remote pre-auth trigger, and there is no public exploit code or scanner template yet. Given transformers' ubiquity across training, fine-tuning, and inference pipelines, treat any model artifact pulled from an untrusted or unverified source as hostile until the fix ships; track the linked GitHub issues/VulnCheck advisory for the patched release and upgrade promptly. In the meantime, restrict `trust_remote_code`-style workflows and only load checkpoints from vetted, pinned-revision sources on hosts that don't hold sensitive local secrets.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Medium severity (CVSS 5.5) reflecting a confidentiality-only impact restricted to local file disclosure — no integrity or availability effect, no remote/network attack vector, and user interaction is required to trigger it (loading a malicious checkpoint). There is no evidence of active exploitation (not in CISA KEV, no SSVC decision, no EPSS score), no public PoC, and no Nuclei template, so real-world exploitation likelihood is currently low. The realistic risk driver is transformers' massive install base and the routine practice of pulling third-party checkpoints from the Hugging Face Hub, which creates many opportunities for a victim to unknowingly load a poisoned index file.

How does the attack unfold?

Malicious Artifact Staging

Adversary publishes a model repository on the Hugging Face Hub with a checkpoint index file containing shard filenames with path traversal or absolute paths.

AML.T0010.003

User Execution

A developer or automated pipeline loads the malicious checkpoint via from_pretrained(), causing transformers to parse the untrusted index file.

AML.T0011.000

Path Traversal Exploitation

The unsanitized shard filenames are joined with the model directory path without validation, causing the library to open a file outside the intended directory.

Impact: Local File Disclosure

Contents of the targeted file (e.g., credentials, SSH keys, config) are read into the process and can be surfaced via errors, logs, or subsequent exfiltration.

AML.T0037

Malicious Artifact Staging

Adversary publishes a model repository on the Hugging Face Hub with a checkpoint index file containing shard filenames with path traversal or absolute paths.

AML.T0010.003

User Execution

A developer or automated pipeline loads the malicious checkpoint via from_pretrained(), causing transformers to parse the untrusted index file.

AML.T0011.000

Path Traversal Exploitation

The unsanitized shard filenames are joined with the model directory path without validation, causing the library to open a file outside the intended directory.

Impact: Local File Disclosure

Contents of the targeted file (e.g., credentials, SSH keys, config) are read into the process and can be surfaced via errors, logs, or subsequent exfiltration.

AML.T0037

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Transformers	pip	—	No patch
164.1K OpenSSF 6.1 9.2K dependents Pushed 2d ago 43% patched ~87d to patch Full package profile →

Do you use Transformers? You're affected.

How severe is it?

CVSS 3.1

5.5 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC Low

PR None

UI Required

S Unchanged

C High

I None

A None

What should I do?

1 step

Upgrade to the patched transformers release referenced in the linked GitHub issues/VulnCheck advisory as soon as it is available. Until patched, only load model checkpoints from trusted, pinned-revision sources (specific commit/revision hashes rather than mutable main branches), avoid loading models from unverified Hugging Face Hub repos or third-party mirrors, and run model-loading workloads with least-privilege filesystem access so a path traversal cannot reach sensitive files. Detection: monitor for transformers processes opening files outside expected model cache directories, and audit CI/training pipelines that auto-pull models for unpinned or untrusted repo references.

How is it classified?

Data Leakage Supply Chain Framework Model AML.T0010.003 - Model AML.T0011.000 - Unsafe AI Artifacts AML.T0037 - Data from Local System

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.3 - AI system verification and validation / third-party and customer requirements

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated and documented

OWASP LLM Top 10

LLM03 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-75104?

Hugging Face Transformers fails to validate shard filenames referenced in a model's checkpoint index file, letting a crafted index containing `../` sequences or absolute paths make the library read files outside the intended model directory. The risk model here is AI supply chain, not network-exposed: an attacker who publishes a poisoned model repository on the Hub, or convinces a developer to `from_pretrained()` a malicious checkpoint, can exfiltrate local secrets such as credentials, SSH keys, or environment config from the machine performing the load. CVSS 5.5 (AV:L/UI:R, confidentiality-only impact) and no EPSS score or CISA KEV listing reflect that this needs local, deliberate model loading rather than a remote pre-auth trigger, and there is no public exploit code or scanner template yet. Given transformers' ubiquity across training, fine-tuning, and inference pipelines, treat any model artifact pulled from an untrusted or unverified source as hostile until the fix ships; track the linked GitHub issues/VulnCheck advisory for the patched release and upgrade promptly. In the meantime, restrict `trust_remote_code`-style workflows and only load checkpoints from vetted, pinned-revision sources on hosts that don't hold sensitive local secrets.

Is CVE-2026-75104 actively exploited?

No confirmed active exploitation of CVE-2026-75104 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-75104?

Upgrade to the patched transformers release referenced in the linked GitHub issues/VulnCheck advisory as soon as it is available. Until patched, only load model checkpoints from trusted, pinned-revision sources (specific commit/revision hashes rather than mutable `main` branches), avoid loading models from unverified Hugging Face Hub repos or third-party mirrors, and run model-loading workloads with least-privilege filesystem access so a path traversal cannot reach sensitive files. Detection: monitor for `transformers` processes opening files outside expected model cache directories, and audit CI/training pipelines that auto-pull models for unpinned or untrusted repo references.

What systems are affected by CVE-2026-75104?

This vulnerability affects the following AI/ML architecture patterns: model checkpoint loading, model serving, training/fine-tuning pipelines, agent frameworks that dynamically load Hugging Face models.

What is the CVSS score for CVE-2026-75104?

CVE-2026-75104 has a CVSS v3.1 base score of 5.5 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

model checkpoint loadingmodel servingtraining/fine-tuning pipelinesagent frameworks that dynamically load Hugging Face models

MITRE ATLAS Techniques

AML.T0010.003 Model

AML.T0011.000 Unsafe AI Artifacts

AML.T0037 Data from Local System

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.3

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling file disclosure and filesystem reconnaissance.

Exploitation Scenario

An adversary publishes a model repository on the Hugging Face Hub (or compromises/typosquats an existing one) containing a checkpoint index file (e.g., `pytorch_model.bin.index.json`) where shard filenames are replaced with `../../../etc/passwd`-style relative paths or absolute paths like `/home/user/.ssh/id_rsa`. A developer, data scientist, or automated fine-tuning pipeline calls `from_pretrained()` on this repo, and the library joins the malicious shard path with the model directory without validation, reading the targeted file into the loading process. The disclosed content can then surface via a crafted deserialization error, be incorporated into model state and later extracted, or be silently read into memory where a colluding component exfiltrates it.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.