AIKIDO-2026-262955

TL;DR

The save_pretrained methods of the base tokenizer and processor classes use dictionary keys from chat-template data as output filenames without validation. A model repository can supply crafted keys containing path traversal sequences in tokenizer_config.json. Saving a tokenizer or processor loaded from such a repository then writes attacker-controlled files outside the intended directory. The fix validates and sanitizes the keys before using them as filenames.