AIKIDO-2026-10911
huggingface-hub is vulnerable to Information Disclosure
39
Low Risk
This Affects:
huggingface-hubTL;DR
The huggingface_hub client writes Hugging Face API tokens to HF_TOKEN_PATH and multi-account tokens to HF_STORED_TOKENS_PATH under the user's cache directory. Before the fix, those files were created with default POSIX modes, often leaving token files world-readable on typical systems. A local user or process with filesystem access to the victim's home directory could read the tokens and authenticate to the Hub as that user. The fix writes secrets through _write_secret, creating parent directories at 0o700 and files at 0o600, and tightens permissions on existing paths on the next save.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
huggingface-hub is vulnerable to Information Disclosure in versions 0.10.0 - 1.15.0.
How to fix this
Upgrade the huggingface-hub library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.