Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to supply malicious index files containing parent-directory references or absolute paths. These paths are joined without validation, enabling attackers to read arbitrary files outside the model directory. This improper limitation of pathname to a restricted directory is classified as a path traversal vulnerability. It affects versions up to 5.15.0. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

An attacker can read arbitrary files outside the intended model directory, potentially disclosing sensitive information and enabling filesystem reconnaissance. The vulnerability requires local access (AV:L) and user interaction (UI:P), with no privileges required (PR:N). The impact on confidentiality is high, while integrity and availability are not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid loading untrusted checkpoint index files to prevent exploitation.