AIKIDO-2026-10911
huggingface-hub is vulnerable to Information Disclosure
68
Medium Risk
This Affects:
huggingface-hubTL;DR
The huggingface_hub client writes Hugging Face API tokens to HF_TOKEN_PATH and multi-account tokens to HF_STORED_TOKENS_PATH under the user's cache directory. Before the fix, those files were created with default POSIX modes, often leaving token files world-readable on typical systems. A local user or process with filesystem access to the victim's home directory could read the tokens and authenticate to the Hub as that user. The fix writes secrets through _write_secret, creating parent directories at 0o700 and files at 0o600, and tightens permissions on existing paths on the next save.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
huggingface-hub is vulnerable to Information Disclosure in versions 0.10.0 - 1.15.0.
How to fix this
Upgrade the huggingface-hub library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant