Disclosed weakness · no CVE recorded

Transformers tightened object access in the chat-template sandbox

Hugging Face · Transformers chat-template rendering

First documented disclosure · Review checkpoint

Summary

Transformers 5.22.2 restricted the objects visible to chat templates. Maintainers identified an underlying Python dictionary issue reachable through the previous sandbox and tightened the handling of caller-supplied objects.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: No exploitation against a deployed inference service was established.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The rendering context exposed more Python capabilities than templates needed. The patch limits dictionary and namespace access and reduces inputs to plain data.

Conditions required

Rendering an untrusted chat template on an affected implementation; the dictionary behavior also depends on the Python runtime.

Potential impact

Untrusted templates could reach unsafe dictionary behavior. The maintainer also reduced the risk from exposed object attributes; the advisory does not demonstrate a complete host compromise.

Affected versions and configurations

Transformers versions using the preceding chat-template implementation; no complete affected package or runtime matrix was supplied.

Fix and mitigation status

Transformers 5.22.2 includes PR 50431. The package fix is distinct from the separate CPython runtime changes discussed by the maintainer.

Practical next steps

Use a maintained Transformers release containing the fix and pass plain data to templates. Review model-supplied templates before enabling them in shared services.

Operating lesson

Keep executable objects out of template inputs even when the renderer has a sandbox.

Evidence and limits

This entry records an AI-library hardening fix with a specific reachable issue. It does not assign a CPython CVE to Transformers or establish remote code execution. No source-attributed numerical severity was found.

Sources