AIKIDO-2026-295187

TL;DR

The tokenizer loading path in transformers reads vocab-file arguments such as vocab_file and merges_file from the untrusted tokenizer_config.json and lets those values take precedence over the repository-resolved paths. When an application loads a tokenizer from an attacker-controlled repository with AutoTokenizer.from_pretrained, a crafted absolute path or a path containing .. is opened verbatim, allowing arbitrary local files outside the repository to be read into the tokenizer. This works even when trust_remote_code is disabled, and the read content can be exfiltrated through save and push-to-hub workflows. The fix makes the repository-resolved path take precedence so only an explicit caller-provided path can override it.