CVE-2026-69112
🟡 Monitoruj
W Hugging Face Accelerate występuje luka umożliwiająca odczyt dowolnych plików i atak DoS.
CVSS
7.1
EPSS
0.1%
Exploit
none
Vendor
Opis źródłowy (NVD)
Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in load_checkpoint_in_model and load_checkpoint_and_dispatch functions that fail to sanitize weight_map entries from sharded checkpoint indexes. Attackers can supply relative paths with ../ sequences or absolute paths to read arbitrary files, or point shard entries at named pipes to cause indefinite blocking and denial of service.
dos path-traversal
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 7.1 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.1% |
| Opublikowano (NVD) | 2026-08-10 20:17:31 UTC |
| Ostatnia modyfikacja (NVD) | 2026-09-16 20:32:21 UTC |
Referencje
- https://github.com/huggingface/accelerate/issues/4067 ([email protected])
- https://github.com/huggingface/accelerate/pull/4070 ([email protected])
- https://github.com/huggingface/accelerate/pull/4138 ([email protected])
- https://www.vulncheck.com/advisories/hugging-face-accelerate-path-traversal-and-dos-via-weight-map ([email protected])