From 8e3def62b7806b45e4846eabeabe2cd6b4539f1e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Krzysztof=20Mizga=C5=82a?= <km.2001@o2.pl>
Date: Sat, 15 Aug 2026 00:27:18 +0200
Subject: [PATCH] Improve GHSA-4j2p-28q2-5m79

---
 .../GHSA-4j2p-28q2-5m79.json                  | 41 +++++++++++++++----
 1 file changed, 33 insertions(+), 8 deletions(-)

diff --git a/advisories/unreviewed/2026/08/GHSA-4j2p-28q2-5m79/GHSA-4j2p-28q2-5m79.json b/advisories/unreviewed/2026/08/GHSA-4j2p-28q2-5m79/GHSA-4j2p-28q2-5m79.json
index 5c55269bb6cc..79eeebf194ce 100644
--- a/advisories/unreviewed/2026/08/GHSA-4j2p-28q2-5m79/GHSA-4j2p-28q2-5m79.json
+++ b/advisories/unreviewed/2026/08/GHSA-4j2p-28q2-5m79/GHSA-4j2p-28q2-5m79.json
@@ -1,23 +1,40 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-4j2p-28q2-5m79",
-  "modified": "2026-08-10T21:32:04Z",
+  "modified": "2026-08-10T21:32:09Z",
   "published": "2026-08-10T21:32:04Z",
   "aliases": [
     "CVE-2026-69112"
   ],
-  "details": "Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in load_checkpoint_in_model and load_checkpoint_and_dispatch functions that fail to sanitize weight_map entries from sharded checkpoint indexes. Attackers can supply relative paths with ../ sequences or absolute paths to read arbitrary files, or point shard entries at named pipes to cause indefinite blocking and denial of service.",
+  "summary": "Hugging Face Accelerate vulnerable to path traversal via unsanitized sharded-checkpoint weight_map entries",
+  "details": "### Summary\n\n`accelerate` through 1.14.0 does not sanitize the shard filenames read from a sharded\ncheckpoint's `*.index.json` `weight_map` before joining them to the checkpoint folder. A crafted\ncheckpoint can make the loader open files outside the intended directory, or block indefinitely\non a named pipe.\n\n### Details\n\n`load_checkpoint_in_model()` in `src/accelerate/utils/modeling.py` builds its shard list directly\nfrom attacker-controlled index values:\n\n```python\ncheckpoint_files = sorted(list(set(index.values())))\ncheckpoint_files = [os.path.join(checkpoint_folder, f) for f in checkpoint_files]\n```\n\n`os.path.join()` follows `..` segments, and discards the base folder entirely when the second\nargument is absolute, so a `weight_map` entry such as `../../../../etc/passwd` or an absolute path\nresolves outside `checkpoint_folder`.\n\nThe same code path is reachable through `load_checkpoint_and_dispatch()`. No `trust_remote_code`\nflag or other opt-in is required — plain `load_checkpoint_in_model(model, \"<dir>\")` is enough.\n\n### Impact\n\n- **Path traversal / arbitrary file read** — an out-of-directory file open, which also works as an\n  existence-and-parse oracle for paths on the host.\n- **Denial of service** — a shard entry pointing at a FIFO makes the `torch.load` branch block\n  indefinitely.\n\nThis is not remote code execution: safetensors shards go through `safe_open`, and the torch branch\nalready passes `weights_only=True`.\n\n### Affected versions\n\nAll released versions up to and including 1.14.0, which is the latest release on PyPI and the\nlatest tag in the repository.\n\n### Patches\n\nNone at time of writing. The proposed fix in huggingface/accelerate#4138 is still open; an earlier\nattempt (#4070) was closed by the stale bot without review, and the vulnerable code is still\npresent on `main`.\n\n### Workarounds\n\nLoad sharded checkpoints only from trusted sources, or validate before calling\n`load_checkpoint_in_model()` / `load_checkpoint_and_dispatch()` that every value in the index's\n`weight_map` is a relative path that normalizes to a location inside the checkpoint folder.",
   "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"
-    },
     {
       "type": "CVSS_V4",
-      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "accelerate"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "1.14.0"
+            }
+          ]
+        }
+      ]
     }
   ],
-  "affected": [],
   "references": [
     {
       "type": "ADVISORY",
@@ -35,6 +52,14 @@
       "type": "WEB",
       "url": "https://github.com/huggingface/accelerate/pull/4138"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/huggingface/accelerate"
+    },
+    {
+      "type": "WEB",
+      "url": "https://pypi.org/project/accelerate"
+    },
     {
       "type": "WEB",
       "url": "https://www.vulncheck.com/advisories/hugging-face-accelerate-path-traversal-and-dos-via-weight-map"