The vulnerability (CVE-2026-9856) affects huggingface/transformers versions <=5.8.0.dev0. It arises from improper validation of keys used as filenames in the save_pretrained() methods of PreTrainedTokenizerBase and ProcessorMixin classes. An attacker can publish a malicious repository on the Hugging Face Hub containing a crafted tokenizer_config.json file with keys that escape the intended save directory via path traversal. When a victim downloads and saves the tokenizer or processor, arbitrary files can be written with attacker-controlled content. This impacts multiple processors inheriting from ProcessorMixin, such as Idefics, Florence, Gemma, Phi, and Qwen-VL. The CVSS v3.0 score is 7.1, indicating a high severity vulnerability with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact.

Successful exploitation allows an attacker to write arbitrary files on the victim's filesystem outside the intended directory. This can lead to integrity violations by overwriting or creating files with attacker-controlled content. There is no direct confidentiality impact reported. The attack requires the victim to download and save a malicious tokenizer or processor from a crafted Hugging Face Hub repository. Availability impact is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid downloading and saving tokenizers or processors from untrusted or unknown Hugging Face Hub repositories. Monitor official Hugging Face channels for updates or patches addressing this vulnerability.