AI analysis
CVE-2026-80047 is a flaw in Hugging Face Transformers (versions 4.49.0 through 5.8.1) in which GenerativePreTrainedModel.load_custom_generate() writes a remote Python file (custom_generate/generate.py) from a model repository to the local ~/.cache/huggingface/modules directory before performing the required trust_remote_code consent check. The unconditional file write in dynamic_module_utils.py occurs even when the user declines the trust prompt, inverting the consent-first model enforced by AutoConfig, AutoModel, and AutoTokenizer. Execution of the code is correctly gated, but the write is persistent, so attacker-controlled code remains on disk and can later be executed via stale-cache collisions during otherwise trusted model loads. Affected users are developers, CI pipelines, and applications running affected Transformers versions that load custom generate implementations from remote repositories. There is currently no public proof-of-concept, no known exploitation (EPSS 0.1%), and the issue is not in CISA KEV; it was assigned by CERT/CC under VU#456290.
What to do: Upgrade Transformers to a fixed release newer than 5.8.1 when available; until then, avoid calling load_custom_generate() on untrusted model repositories. Audit ~/.cache/huggingface/modules for custom_generate/generate.py files written without consent and remove stale cached modules, since cached attacker code can be executed during later trusted model loads.
Affected
| Hugging Face Transformers | >= 4.49.0 and <= 5.8.1 |
Estimated exposure
nichelikely low thousands of environments at most (niche load_custom_generate() API within a library downloaded tens of millions of times monthly) — Transformers is one of the most widely downloaded Python ML libraries (tens of millions of monthly downloads), but this flaw requires the rarely used load_custom_generate() call against a repository hosting custom_generate/generate.py, so…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A vulnerability in Hugging Face Transformers (versions >= 4.49.0 and <= 5.8.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). The function fetches and caches a remote module file before performing the required trust_remote_code consent check, inverting the security model enforced by other code-loading paths (such as AutoConfig, AutoModel, and AutoTokenizer). As a result, attacker‑controlled Python code from custom_generate/generate.py is copied into the user’s ~/.cache/huggingface/modules directory even if the user declines the trust prompt. Although execution is correctly gated, the file write is not reversible and can persist across sessions. This can lead to persistent, unauthorized files on disk and stale cache collisions where cached attacker code may later be executed during trusted model loads. The issue stems from an unconditional file write in dynamic_module_utils.py prior to any trust verification.