A newly disclosed vulnerability in the Hugging Face Transformers library could allow attacker-controlled Python files to be written to a victim’s system before the user approves the execution of remote code.
This vulnerability is tracked as CVE-2026-80047 and affects Transformers versions 4.49.0 through 5.8.1. According to the CERT Coordination Center Vulnerability Note VU#456290, the flaw lies in the library’s custom generation-code loading process, undermining the expected protection provided by the trust_remote_code prompt.
Hugging Face Transformers Flaw
Hugging Face Transformers is widely used for training and running machine learning models in natural language processing, computer vision, audio, video, and multimodal tasks.
The affected functionality, `GenerativePreTrainedModel.load_custom_generate()`, allows models hosted in repositories to supply custom generation logic.
The vulnerable workflow retrieves a remote module and writes it to the local Hugging Face module cache before determining whether the user has authorized the remote code.
Specifically, the Transformers library calls `get_cached_module_file()` to download and cache the `custom_generate/generate.py` file from the repository before invoking `resolve_trust_remote_code()`.
While the library blocks execution when a user declines the prompt, the remote Python file has already been copied to disk. The content is stored in the default local cache location, `~/.cache/huggingface/modules`, where it can remain even after the model-loading attempt concludes.
CERT/CC noted that this behavior violates the security contract used by other dynamic remote-code loading mechanisms in the Transformers ecosystem. Components such as `AutoConfig`, `AutoModel`, `AutoTokenizer`, and `AutoImageProcessor` perform trust_remote_code verification before fetching or writing remote Python content.
The underlying issue stems from an unconditional file-copy operation in `dynamic_module_utils.py`. Since the write occurs before user consent is evaluated, it cannot be rolled back if the user rejects the remote code request.
An attacker could exploit this flaw by publishing a malicious model repository that contains a crafted `custom_generate/generate.py` file. Any user or automated environment that loads the affected model reference may trigger the cache write without needing elevated privileges, and without any interaction beyond initiating the model load.
The risk is particularly significant in shared development, research, CI/CD, and inference environments where Hugging Face caches persist or are reused. A malicious file deposited during a previous rejected load could later be accessible when a trusted model-loading workflow accesses cached module content, potentially leading to unintended code execution.
At the time of publication, CERT/CC reported that there was no vendor-provided patch or advisory available. Organizations are advised to avoid using `load_custom_generate()` with untrusted repositories, inspect Hugging Face module cache directories for unexpected files, and clear cached modules when suspicious content is found. Developers should ensure that remote-code trust checks occur before downloading or writing any untrusted Python module.
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
