Vulnerability · Published Aug 10, 2026 · Assigned by VulnCheck

CVE-2026-69112Hugging Face Accelerate 1.14.0 Path Traversal and DoS via weight_map

High 7.1

In plain English

A high-severity path traversal in accelerate from huggingface. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.2%top 91.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in load_checkpoint_in_model and load_checkpoint_and_dispatch functions that fail to sanitize weight_map entries from sharded checkpoint indexes. Attackers can supply relative paths with ../ sequences or absolute paths to read arbitrary files, or point shard entries at named pipes to cause indefinite blocking and denial of service.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	accelerate	no fix listed	GHSA-4j2p-28q2-5m79
PyPI	accelerate	no fix listed	PYSEC-2026-3804

Affected products (as reported)

Vendor	Product	Versions
huggingface	accelerate	0 – through 1.14.0

Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

References

Researcher Disclosure technical-description, exploit
Pull Request (1) issue-tracking
Pull Request (2) issue-tracking
https://www.vulncheck.com/advisories/hugging-face-accelerate-path-traversal-and-dos-via-weight-map third-party-advisory