Insecure Temporary File in huggingface/transformers

The vulnerability is an insecure temporary file issue in the Hugging Face Transformers library (versions prior to 4.30.0). The root cause is the use of the deprecated mktemp function for creating temporary files, which is inherently insecure because it does not atomically create the file, leaving a race window for attackers [1][4].

Exploitation is local and requires access to a user account on the system where Transformers is used. During operations that create temporary files—such as model caching or tokenizer downloads—an attacker who can predict the temporary filename can plant a symbolic link (symlink) pointing to an arbitrary file the victim can write to. When the library then writes to the insecure temporary file, it inadvertently follows the symlink and overwrites the target file [2][3].

The impact is local privilege escalation or denial of service. A successful attacker could overwrite critical system files, user configuration, or other sensitive data that the victim user has write permissions to. This can lead to arbitrary code execution in the context of the victim user or cause a system crash [2].

The issue has been patched in Transformers version 4.30.0. The fix replaces the deprecated mktemp with mkstemp, which creates temporary files securely and atomically. Users should upgrade to the latest version immediately [1][4]. No workaround is available for unpatched versions.