AIKIDO-2026-614493

TL;DR

Affected versions of transformers are vulnerable to path traversal when loading a local model with from_pretrained. An untrusted transformers_weights value in config.json was joined onto the model directory after only a suffix check, with no containment validation. A crafted local model can therefore make the loader open a .safetensors file outside the model directory without trust_remote_code, enabling out-of-directory weight reads and path existence checks.