AIKIDO-2026-272899

huggingface-hub is vulnerable to Information Disclosure

Information Disclosure Pre-CVE Published Aug 11, 2026

Medium Risk

This Affects:

huggingface-hub

1.22.0 - 1.25.0

Fixed in 1.25.1

Are you affected? Scan for Free

TL;DR

The Sandbox feature in huggingface_hub runs code inside Hugging Face Jobs and downloads the sbx-server binary during job bootstrap. The bootstrap logic injects the user's reusable Hugging Face token into the sandbox job as the SBX_DL_TOKEN secret and sends it in an Authorization header, and it does so unconditionally even when forward_hf_token is disabled. Code running inside the sandbox, including untrusted images or workloads, can read this token from the job environment and reuse it to act as the user on the Hub. The fix stops setting SBX_DL_TOKEN, downloads the public binary anonymously, and keeps the raw token out of the sandbox unless token forwarding is explicitly enabled.

Who does this affect?

You are affected if you run a vulnerable version and use the Sandbox or SandboxPool feature to execute untrusted or externally provided code (or a caller-chosen image) in Hugging Face Jobs. That in-sandbox code can read your reusable Hugging Face token from the job environment and reuse it against your Hub account, even when forward_hf_token is left at its default of False. Code that never uses the sandbox feature, or only runs fully trusted workloads in it, is not exposed.