AIKIDO-2026-10189

TL;DR

Affected versions of this package contain a safe mode bypass in tokenizer implementations (BytePairTokenizer, WordPieceTokenizer, and SentencePieceTokenizer) that allows arbitrary file reads even when safe_mode=True. An attacker able to control tokenizer configuration, model artifacts, or input paths could exploit this flaw by forcing the tokenizer to load vocabulary or proto files from unintended external locations, resulting in unauthorized access to sensitive files (e.g., credentials, system configuration, or secrets). This can enable credential exfiltration or data leakage, particularly in AI supply chain or model loading workflows where untrusted artifacts are processed.