Originally published at HOL
CVE-2026-69112: Hugging Face Accelerate Path Traversal Lets Attackers Read Arbitrary Files from Checkpoint Indexes
TL;DR: Hugging Face Accelerate through version 1.14.0 fails to sanitize weight_map entries in sharded checkpoint indexes. An attacker who controls a checkpoint index file can supply relative paths with parent-directory traversal sequences or absolute paths to read arbitrary files from the filesystem, or point shard entries at named pipes to cause indefinite blocking and denial of service. The vulnerability affects the load_checkpoint_in_model and load_checkpoint_and_dispatch functions.
What happened
The attack chain starts with a sharded model checkpoint. Hugging Face Accelerate uses index files (typically model.safetensors.index.json or pytorch_model.bin.index.json) to map weight tensor names to the shard files that contain them. The weight_map inside these index files is a dictionary where each key is a tensor name and each value is the filename of the shard holding that tensor.
