CyberRota Analysis
AI-GeneratedHugging Face Accelerate versions up to 1.14.0 are vulnerable to a path traversal issue in the load_checkpoint_in_model and load_checkpoint_and_dispatch functions, allowing attackers to manipulate weight_map entries. This can lead to unauthorized file access or denial of service through indefinite blocking by targeting named pipes. Organizations using this library should prioritize patching to mitigate potential data exposure and service disruption risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in load_checkpoint_in_model and load_checkpoint_and_dispatch functions that fail to sanitize weight_map entries from sharded checkpoint indexes. Attackers can supply relative paths with ../ sequences or absolute paths to read arbitrary files, or point shard entries at named pipes to cause indefinite blocking and denial of service.