VU#456290: Hugging Face Transformers library writes remote code to disk prior to consent check
CVE-2026-80047: Hugging Face Transformers 4.49.0 through 5.8.1 writes attacker-controlled Python files to disk before the trust_remote_code consent check.
CERT/CC vulnerability note VU#456290 describes CVE-2026-80047 in the Hugging Face Transformers library, affecting versions 4.49.0 through 5.8.1. The library performs a remote module fetch and writes attacker-controlled Python files to the local disk before evaluating the trust_remote_code consent prompt, without user authorization. This violates the security contract enforced across other dynamic module-loading paths in the library. Transformers is a primary framework for training and inference across NLP, vision, audio, video, and multimodal machine learning systems.
- Affects Hugging Face Transformers versions 4.49.0 through 5.8.1
- Remote module fetch and local cache write occur before trust_remote_code consent
- Tracked by CERT/CC as VU#456290 and CVE-2026-80047
- Impact is unauthorized local file writes rather than immediate code execution
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-80047 | Pre-Consent Remote Python File Write in Hugging Face Transformers CVE-2026-80047 is a flaw in Hugging Face Transformers (versions 4.49.0 through 5.8.1) in which GenerativePreTrainedModel.load_custom_generate() writes a remote Python file (custom_generate/generate.py) from a model repository to the local ~/.cache/huggingface/modules directory before performing the required trust_remote_code consent check. The unconditional file write in dynamic_module_utils.py occurs even when the user declines the trust prompt, inverting the consent-first model enforced by AutoConfig, AutoModel, and AutoTokenizer. Execution of the code is correctly gated, but the write is persistent, so attacker-controlled code remains on disk and can later be executed via stale-cache collisions during otherwise trusted model loads. Affected users are developers, CI pipelines, and applications running affected Transformers versions that load custom generate implementations from remote repositories. There is currently no public proof-of-concept, no known exploitation (EPSS 0.1%), and the issue is not in CISA KEV; it was assigned by CERT/CC under VU#456290. Do: Upgrade Transformers to a fixed release newer than 5.8.1 when available; until then, avoid calling load_custom_generate() on untrusted model repositories. Audit ~/.cache/huggingface/modules for custom_generate/generate.py files written without consent and remove stale cached modules, since cached attacker code can be executed during later trusted model loads. | 7.8 | <1% |
| nichelikely low thousands of environments at most (niche load_custom_generate() API within a library downloaded tens of millions of times monthly) |
Overview A vulnerability in the Hugging Face Transformers library (versions 4.49.0 through 5.8.1) allows remote, attacker‑controlled Python files to be written to the local disk without user authorization. The library performs a remote module fetch and local cache write before evaluating the trust_remote_code consent prompt, violating the security contract enforced across other dynamic module-loading paths in the library. Description Hugging Face Transformers serves as a primary framework for defining and operating modern machine learning models including NLP, computer vision, audio, video, and multimodal systems, for both training and inference. As detailed in CVE‑2026‑80047, affected…
This source does not provide full text. Read it at kb.cert.org.