Arbitrary File Write via Path Traversal in Hugging Face Transformers

Executive Summary

This vulnerability allows an attacker to write arbitrary files to a victim's system through path traversal. It exists in Hugging Face Transformers versions up to 5.8.0.dev0, specifically in the save_pretrained() methods of PreTrainedTokenizerBase and ProcessorMixin. Attackers exploit this by publishing a malicious Hugging Face Hub repository with a crafted tokenizer_config.json file. When a victim downloads and saves the tokenizer or processor, attacker-controlled keys in the chat_template dictionary can escape the intended save directory, enabling arbitrary file writes with attacker-controlled content.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Hugging Face Transformers installations for versions <=5.8.0.dev0. Check for unauthorized file writes in directories where tokenizers or processors are saved. Review tokenizer_config.json files in downloaded repositories for malicious chat_template keys.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to overwrite critical system files, install malware, or gain control of your system. If you use affected Hugging Face Transformers versions, an attacker could trick you into downloading a malicious tokenizer or processor, leading to arbitrary file writes on your machine. This could compromise your system integrity, data security, and privacy.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by enabling arbitrary file writes. Attackers may overwrite sensitive files like configuration files or logs, potentially exposing or altering protected health information (PHI) under HIPAA or personal data under GDPR. Unauthorized file modifications could also violate integrity and confidentiality requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Update huggingface/transformers to a version greater than 5.8.0.dev0 to address the arbitrary file write vulnerability. Avoid using untrusted Hugging Face Hub repositories or verify the integrity of tokenizer_config.json files before downloading and saving tokenizers or processors.

Useful 0 Not Useful 0