Hugging Face Transformers: Hugging Face Transformers downloads custom generation code before trust consent
Hugging Face Transformers
More for Hugging Face Transformers RSS feed for Hugging Face Transformers
- Severity
- High, CVSS 7.8
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-80047
- Affects
- Hugging Face Transformers
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- September 1, 2026
- Source last modified
- September 30, 2026
Description
A vulnerability in Hugging Face Transformers (versions 4.49.0, <= 5.8.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). The function fetches and caches a remote module file before performing the required trust_remote_code consent check, inverting the security model enforced by other code-loading paths (such as AutoConfig, AutoModel, and AutoTokenizer). As a result, attacker‑controlled Python code from custom_generate/generate.py is copied into the user’s ~/.cache/huggingface/modules directory even if the user declines the trust prompt. Although execution is correctly gated, the file write is not reversible and can persist across sessions. This can lead to persistent, unauthorized files on disk and stale cache collisions where cached attacker code may later be executed during trusted model loads. The issue stems from an unconditional file write in dynamic_module_utils.py prior to any trust verification.
Description quoted from the NVD record.
Who is affected
Hugging Face Transformers is a software toolkit that programmers use to build and run AI models. This flaw affects versions 4.49.0 through 5.8.1, in the feature that loads custom code for producing text that can come with a model. The product saves that code onto the computer before asking whether you trust it, and keeps it even if you say no. The code does not run at that point, but the file stays and could later run when you load a model you do trust. An attacker who supplies such a model could use this to plant harmful code. This flaw is rated High.
What to do
- Ask whoever builds or runs AI software for your organization whether they use Hugging Face Transformers, and which version.
- If someone on your team installed it, they should update it to a fixed release as soon as one is available. No fixed version is named for this flaw yet, so check the vendor advisory linked on this page for a fixed release.
- If an IT provider or software vendor runs it for your organization, send them this advisory and ask when the update will be done.
Analysis written from the source record as of September 30, 2026 and reviewed before publishing.