The vulnerability arises from improper validation of shard filenames in checkpoint index files within Hugging Face Transformers. Attackers can exploit this by creating malicious index files containing directory traversal sequences or absolute paths, which the software does not restrict properly. This flaw enables unauthorized access to files outside the designated model directory, leading to potential file disclosure and reconnaissance of the filesystem. No known exploits are reported in the wild. The vulnerability affects all versions of the transformers library.

Successful exploitation allows an attacker to read arbitrary files on the filesystem outside the intended model directory, which can lead to unauthorized disclosure of sensitive information and facilitate further reconnaissance. There is no indication of privilege escalation or remote code execution. The attack requires local access or the ability to supply malicious checkpoint index files.

No official patch or remediation is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should avoid loading untrusted checkpoint index files and restrict access to trusted sources only.