The vulnerability resides in the save_pretrained() methods of PreTrainedTokenizerBase and ProcessorMixin in huggingface/transformers versions <=5.8.0.dev0. The methods use keys from the chat_template dictionary directly as filenames without proper sanitization, enabling path traversal. An attacker can publish a malicious Hugging Face Hub repository containing a crafted tokenizer_config.json file with attacker-controlled keys. When a victim downloads and saves the tokenizer or processor, these keys can cause files to be written outside the intended directory, leading to arbitrary file writes with attacker-controlled content. This affects multiple processors inheriting from ProcessorMixin, such as Idefics, Florence, Gemma, Phi, and Qwen-VL.

An attacker can cause arbitrary file writes on the victim's system by exploiting the path traversal vulnerability during the save_pretrained() operation. This can lead to integrity violations by overwriting or creating files outside the intended directory. The vulnerability does not directly impact confidentiality or availability but poses a high risk to system integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid downloading and saving tokenizers or processors from untrusted or unverified Hugging Face Hub repositories, especially those that may contain malicious tokenizer_config.json files. Monitor vendor channels for updates and apply patches promptly once released.