Transformers 5.22.2 Strengthens Chat Template Sandbox, Restricts Object Attribute Access and Input Types

Hugging Face released Transformers 5.22.2 on November 6, incorporating hardening of the Jinja sandbox for chat templates into an official patch release. For inference services that load templates from model repositories, this update affects the data-processing boundary before generation and merits review alongside model weights and the inference runtime. Release notes

Chat templates combine roles, message content, and control tokens into the token sequence used by a model, so they directly participate in preprocessing for every request. The official documentation notes that different models may use different formats and that incorrect control tokens can hurt performance. Engineering teams typically need to use the template associated with each model, which also means managing the template execution environment. Chat templating documentation

The maintainers say in the patch notes that dict objects accessible inside the sandbox could trigger an array overflow issue in CPython. The change replaces them with a dictionary interface that exposes only a small set of methods, and restricts namespace from storing attributes that begin with an underscore, reducing templates’ access to internal mechanisms. This describes the maintainers’ stated motivation for the patch; the public notes do not provide a complete matrix of affected environments. Patch proposal

Another change sanitizes data before it is exposed to templates, including conversations, tool structures, documents, and extra parameters. Common containers are converted recursively, with corresponding handling for NumPy scalars, dataclasses, and Pydantic models. Other objects are converted to placeholder text containing their type name, preventing templates from accessing additional capabilities through methods on objects such as images and arrays. The minimum jinja2 requirement also rises from 3.1.0 to 3.1.6. Code diff

Based on these changes, upgrade validation should cover custom object fields, multimodal content, and template rendering results, as well as verify pinned dependency versions. Jinja’s official guidance also warns that the sandbox should be combined with exception handling and CPU and memory limits; this update should not be treated as eliminating all template risks. Teams should watch for compatibility reports and a more complete security advisory. Jinja security considerations