{
 "id": "AIR-2026-0088",
 "slug": "cve-2026-75104-hugging-face-transformers-vulnerable-to-arbit",
 "title": "CVE-2026-75104: Hugging Face Transformers vulnerable to arbitrary file read",
 "summary": "Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. The flaw enables filesystem reconnaissance and file disclosure.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Transformers"
 ],
 "incident_date": "2026-08-17",
 "incident_date_precision": "day",
 "first_reported": "2026-08-17",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75104",
   "publisher": "NVD",
   "title": "CVE-2026-75104: Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files…",
   "published_at": "2026-08-17"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-75104",
  "huggingface",
  "path_traversal"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}