CVE-2026-69112PoC

LOWCVSS 6.9 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in load_checkpoint_in_model and load_checkpoint_and_dispatch functions that fail to sanitize weight_map entries from sharded checkpoint indexes. Attackers can supply relative paths with ../ sequences or absolute paths to read arbitrary files, or point shard entries at named pipes to cause indefinite blocking and denial of service.

Back to dashboard

1.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Threat summary

Public PoC is present in monitored signal
1 mentions across 1 observed day

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

PoC

1100.0%

Referenced assets1 URL

By indicator

https://hol.org/blog/cve-2026-69112-hugging-face-accelerate-path-traversal

Full discourse1 post

HOL@HashgraphOnline46d
PoC
CVE-2026-69112: path traversal in Hugging Face Accelerate (through 1.14.0). Malicious sharded checkpoint indexes can read arbitrary files via weight_map paths, or hang loaders via named pipes. 27M monthly downloads exposed. No patch yet. Validation code inside: https://hol.org/blog/cve-2026-69112-hugging-face-accelerate-path-traversal
Post summary
CVE-2026-69112 exposes a path‑traversal flaw in Hugging Face Accelerate 1.14.0, allowing arbitrary file reads through malicious checkpoint indexes, with validation code provided but no patch yet.
00071863
19.2K followersView on X

Explore more

Back to dashboard