CVE-2026-69112 | Hugging Face Accelerate up to 1.14.0 Sharded Checkpoint Index weight_map path traversal

A vulnerability, which was classified as critical, was found in Hugging Face Accelerate up to 1.14.0. Affected by this issue is the function load_checkpoint_in_model/load_checkpoint_and_dispatch of the component Sharded Checkpoint Index. Such manipulation of the argument weight_map leads to path traversal.

This vulnerability is uniquely identified as CVE-2026-69112. The attack can be launched remotely. No exploit exists.