CVE-2026-9856: huggingface/transformers <5.10.0: path traversal via chat template dict keys in save pretrained → arbitrary file write → RCE cron.d drop

huggingface/transformers <5.10.0 contains a path traversal (CWE-22) in save_pretrained(). When a tokenizer (or processor) is loaded from an attacker-controlled artifact whose tokenizer_config.json carries a chat_template dictionary, the dictionary keys are used verbatim as filenames by save_chat_templates() (src/transformers/tokenization_utils_base.py) and by ProcessorMixin.save_pretrained() (src/transformers/processing_utils.py): template_filepath = os.path.join(chat_template_dir, f"{template_name}.jinja") with no sanitization. A traversal key such as ../../../etc/cron.d/hf_pwn escapes the save directory and writes fully attacker-controlled content (with a forced .jinja suffix) anywhere the victim process can write. This run demonstrates the full impact chain: the escaped file is dropped into /etc/cron.d, where a pre-existing, genuine cronie daemon naturally loads it and independently spawns /bin/sh running the attacker's command — arbitrary code execution with the victim's privileges.

• Package: huggingface/transformers (save_pretrained of PreTrainedTokenizerBase and ProcessorMixin).
• Affected versions: >=4.52.0, <5.10.0 (verified vulnerable: 5.9.0; NVD's <=5.8.0.dev0 understates the range).
• Fixed versions: 5.10.0 (yanked ~20 min after release) / 5.10.1+.
• Risk: High. A victim application that loads an attacker-controlled model (from_pretrained) and later calls save_pretrained() — automatic in Trainer checkpointing, model conversion/re-hosting, and fine-tune export — writes attacker-controlled content to arbitrary filesystem paths. Realistic execution targets include /etc/cron.d (cron ignores the .jinja extension) and overwriting existing .jinja templates rendered by a service. CVSS UI:R; the attacker needs no authentication.

Impact Parity

• Disclosed/claimed maximum impact: arbitrary file write → remote/code execution (e.g., cron.d drop), code_execution.
• Reproduced impact from this run: code_execution — two fresh, isolated victim processes running real transformers==5.9.0 each produced a unique marker file written by a /bin/sh process that the genuine cronie 1.7.2 daemon independently spawned from the attacker-controlled /etc/cron.d/hf_pwn.jinja. The identical artifact against transformers==5.10.1 raised ValueError, wrote no cron file, and produced no marker.
• Parity: full.
• Not demonstrated: nothing — the claimed code-execution impact was reproduced end to end through the real library API and a real system daemon.

Root Cause

save_chat_templates() iterates tokenizer.chat_template.items() when the chat template is a dict and computes template_filepath = os.path.join(chat_template_dir, f"{template_name}.jinja"). template_name comes verbatim from tokenizer_config.json, which is fully attacker-controlled when the model artifact is untrusted. No normalization or containment check is applied, so keys containing .. (or absolute paths) escape OUT/additional_chat_templates/. The library only mkdirs its own additional_chat_templates dir, so the write succeeds whenever the attacker-chosen parent directory (e.g. /etc/cron.d) already exists and is writable by the victim. The identical flaw exists in ProcessorMixin.save_pretrained() (processing_utils.py).

Fix: PR #46191, merge commit eaaaf8494dd5386634ae37d1d122212fdc315be5 (2026-05-25), first shipped in 5.10.0/5.10.1. The fix resolves template_filepath's parent and compares it to the resolved chat_template_dir, raising ValueError on mismatch (a 3-line guard in both files), plus regression tests using a ../../PWNED key.

Reproduction Steps

1. bundle/repro/reproduction_steps.sh (self-contained; helper: bundle/repro/hf_cron_exploit.py).
2. The script:
   • Anchors source identity to the fixed commit eaaaf8494dd5386634ae37d1d122212fdc315be5: its parent (47949d3a0e1cf9248f2a3eb3cd0deb12ee37b9e9) lacks the guard, the fix commit contains it (logs/source_identity.log).
   • Builds two Docker images from the immutable fedora:42 digest with cronie 1.7.2 and the exact PyPI releases transformers==5.9.0 (vulnerable) and transformers==5.10.1 (fixed).
   • In each isolated container: starts a real crond before the attacker input, builds a tokenizer whose tokenizer_config.json contains chat_template = {"../../../etc/cron.d/hf_pwn": "* * * * * root /bin/sh -c \"echo '<unique-marker>' > /proof/<unique-marker>.txt\""}, then calls the real API AutoTokenizer.from_pretrained(dir).save_pretrained(out).
   • Waits for cronie to naturally load /etc/cron.d/hf_pwn.jinja and spawn the payload; the script never executes the dropped file.
   • Runs two fresh vulnerable victims and one fixed negative control.
3. Expected evidence: SAVE_RESULT=RETURNED, CRON_FILE_PRESENT=true, CRON_CONTENT_MATCH=true, cronie's own log_it ... CMD (/bin/sh -c ...) line, and a unique marker file per vulnerable attempt; SAVE_RESULT=BLOCKED / CRON_FILE_PRESENT=false / no marker for the fixed control.

Evidence

• bundle/logs/reproduction_steps.log — full driver log (two consecutive full passes succeeded; markers ...-1651 then ...-2249).
• bundle/logs/source_identity.log — fix-commit anchor and guard diff.
• bundle/logs/vulnerable_cron_attempt1.log, bundle/logs/vulnerable_cron_attempt2.log — SAVE_RESULT=RETURNED, CRON_FILE_PRESENT=true, CRON_CONTENT_MATCH=true, MARKER_PRESENT=true, and cronie lines such as log_it: (root 92) CMD (/bin/sh -c "echo 'CVE-2026-9856-RCE-VULNERABLE-1-2249' > /proof/...").
• bundle/logs/fixed_cron_control.log — SAVE_RESULT=BLOCKED, CRON_FILE_PRESENT=false, MARKER_PRESENT=false (ValueError guard).
• bundle/repro/marker_run1.txt, bundle/repro/marker_run2.txt — unique per-attempt markers written by the crond-spawned shell.
• bundle/repro/negative_control_fixed.json — strict negative-control observation (target_path_reached=true, marker_present=false).
• bundle/repro/runtime_manifest.json — entrypoint function_call, target identity, and artifact digests.
• Environment: Docker 27.5.1, immutable base fedora@sha256:99e203b80b1c3d8f7e161ec10a68fd02b081ef83a3963553e513c82846b97814, cronie 1.7.2, Python 3.13, transformers==5.9.0 / 5.10.1, x86_64.

Recommendations / Next Steps

• Upgrade to transformers>=5.10.1 (5.10.0 was yanked).
• The upstream guard (resolve the template path's parent and require it to equal the resolved chat_template_dir) is the correct containment fix; downstream backports should mirror it in both tokenization_utils_base.py and processing_utils.py.
• Defensive controls: never call save_pretrained() on artifacts loaded from untrusted sources without sandboxing; run converters/exporters with least privilege so /etc/cron.d and similar directories are not writable.
• Detection: watch for non-system processes opening files under /etc/cron.d, and for processes whose parent is crond executing unexpected commands.

Additional Notes

• Idempotency: the script was executed twice consecutively in this run; both passes confirmed (exit 0), with fresh unique markers per pass. Images are rebuilt deterministically from the immutable base digest; per-attempt containers are removed after each case.
• The forced .jinja suffix does not prevent cron execution: cronie loads every file in /etc/cron.d regardless of extension. The write requires the victim to have write permission on the chosen parent directory (root in the demonstration container, matching the ticket's stated precondition).
• from_pretrained() alone is safe; save_pretrained() is the trigger.
• This run independently revalidated the durable mechanics from prior exploit-knowledge records (arbitrary write primitive 793c4388-299a-489f-a791-5e7b7f2e66d3, crond-mediated control flow ffcce804-7fa3-4ec4-a772-357db3da686c, command-execution capability 19959132-b2f0-4e9f-8e66-d7e6ab23edf5) with fresh current-run evidence.