CVE lookup

CVE-2026-9856

Pruva has a verified reproduction for CVE-2026-9856: huggingface/transformers <5.10.0: path traversal via chat_template dict keys in save_pretrained() → arbitrary file write → RCE (cron.d drop). The canonical evidence record is REPRO-2026-00321.

REPRO

REPRO-2026-00321

Package

Unknown

Severity

HIGH

Status

published

Open verified reproduction Plain text for agents NVD source