Security brief
Transformers chat-template names could escape the intended save directory
REVIEWCVE-2026-9856 involved path traversal when saving tokenizers or processors loaded from crafted repositories.
What happened
A Transformers advisory describes arbitrary file writes through chat-template dictionary keys used as filenames. A malicious repository could supply crafted tokenizer configuration that escaped the intended directory when the tokenizer or processor was saved.
The affected behavior occurs in save_pretrained paths, rather than proving that merely viewing a model page executes code. Several processor families inherit the relevant code, but the common library flaw is the actionable component.
The advisory lists versions below 5.10.0 as affected and 5.10.0 as fixed. Use a maintained release and isolate workflows that download and save untrusted model artifacts, especially where other files or credentials are writable.
Next step
Update Transformers and restrict filesystem access during untrusted model processing.
What we know
- Fixed version
- 5.10.0.
What remains unknown
- Open question
- The sources reviewed do not establish whether your deployment was exploited.
Source references
-
GIT
Technical details
- CVE
CVE-2026-9856