CVE-2026-75104: falha de média gravidade em huggingface transformers
Hugging Face Transformers Path Traversal via Checkpoint Index
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.8epss 0.3%
Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling file disclosure and filesystem reconnaissance.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
huggingface · transformersReferências
https://github.com/huggingface/transformershttps://github.com/huggingface/transformers/blob/main/src/transformers/utils/hub.pyhttps://github.com/huggingface/transformers/issues/47176https://github.com/huggingface/transformers/issues/47177https://www.vulncheck.com/advisories/hugging-face-transformers-path-traversal-via-checkpoint-index