Path Traversal Vulnerability in Hugging Face Accelerate

Hugging Face Accelerate versions up to and including 1.14.0 are affected by a path traversal vulnerability residing within the load_checkpoint_in_model and load_checkpoint_and_dispatch functions. The vulnerability arises because the library fails to properly sanitize the weight_map entries contained within sharded checkpoint index files.

An attacker capable of providing a malicious checkpoint index can use relative path sequences such as ../ or absolute file paths to force the application to read files outside of the intended directory. Furthermore, by pointing a shard entry at a system named pipe, an attacker can trigger indefinite blocking of the process, resulting in a denial of service. This vulnerability poses a significant risk to environments where model checkpoints are sourced from untrusted or external contributors.

Impact

Successful exploitation of this vulnerability allows unauthorized actors to read arbitrary files from the host system, potentially exposing sensitive configuration files, credentials, or other model data. Additionally, the ability to induce a denial of service via named pipes impacts the availability of machine learning inference or training workloads utilizing the affected library.

Recommendation

• Update Hugging Face Accelerate to the latest patched version immediately.
• Implement strict validation of all externally sourced model checkpoint index files before processing them with Accelerate.
• Run model training and inference workloads in isolated, containerized environments with restricted filesystem permissions and read-only access to non-essential directories to limit the impact of path traversal.