CVE-2026-80047 in Transformers
Summary
by MITRE • 09/01/2026
A vulnerability in Hugging Face Transformers (versions 4.49.0, <= 5.8.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). The function fetches and caches a remote module file before performing the required trust_remote_code consent check, inverting the security model enforced by other code-loading paths (such as AutoConfig, AutoModel, and AutoTokenizer). As a result, attacker‑controlled Python code from custom_generate/generate.py is copied into the user’s ~/.cache/huggingface/modules directory even if the user declines the trust prompt. Although execution is correctly gated, the file write is not reversible and can persist across sessions. This can lead to persistent, unauthorized files on disk and stale cache collisions where cached attacker code may later be executed during trusted model loads. The issue stems from an unconditional file write in dynamic_module_utils.py prior to any trust verification.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified within Hugging Face Transformers versions 4.49.0 through 5.8.1 represents a critical flaw in the library's secure code loading architecture, specifically affecting the GenerativePreTrainedModel.load_custom_generate() method. This function is designed to facilitate the dynamic loading of custom generation logic from remote repositories, a feature that inherently carries significant security risks due to the execution of arbitrary Python code. The core technical deficiency lies in the operational sequence within the dynamic_module_utils.py module, where an unconditional file write operation occurs before any trust verification checks are performed. This inversion of the standard security model means that attacker-controlled Python files from custom_generate/generate.py are fetched and cached into the user's local ~/.cache/huggingface/modules directory regardless of whether the user has explicitly consented to trusting remote code via the trust_remote_code prompt.
From a technical perspective, this flaw inverts the principle of least privilege and secure-by-default design patterns typically enforced by other loading paths such as AutoConfig, AutoModel, and AutoTokenizer. These standard methods correctly gate execution behind explicit user confirmation or configuration flags before downloading any external resources. In contrast, the affected load_custom_generate function bypasses this safeguard during the initial fetch phase. While it is noted that actual code execution remains gated by trust verification mechanisms, the persistence of unauthorized files on disk creates a severe integrity risk. The file write operation is irreversible and persists across sessions, meaning that even if a user declines to execute the malicious code in one session, the compromised module remains cached locally. This can lead to stale cache collisions where previously downloaded attacker-controlled code may be inadvertently executed during subsequent trusted model loads if the system fails to distinguish between benign and malicious cached modules or if trust settings are relaxed for other models relying on similar paths.
The operational impact of this vulnerability extends beyond simple unauthorized file creation, posing a significant threat to supply chain integrity and local environment security. The presence of persistent, unauthorized files in the cache directory can be exploited by attackers who have compromised a model repository to plant backdoors or malicious logic that remains dormant until triggered by specific conditions or subsequent interactions with the Hugging Face ecosystem. This behavior aligns closely with CWE-20 Improper Input Validation and CWE-78 Improper Neutralization of Special Elements used in an OS Command, as it involves untrusted data leading to unintended system state changes. Furthermore, from a threat modeling perspective using MITRE ATT&CK techniques, this vulnerability facilitates T1583 Acquire Infrastructure through the establishment of persistent footholds via cached artifacts and supports T1059 Command and Scripting Interpreter by enabling the pre-positioning of executable code that can be activated later without immediate detection.
Mitigation strategies must address both the immediate technical flaw and broader operational practices. The primary remediation involves updating to a patched version of Hugging Face Transformers where the file write operation is strictly deferred until after successful trust verification, ensuring no remote files are persisted unless explicitly authorized by the user or administrator. In environments where an update cannot be immediately applied, operators should manually clear the ~/.cache/huggingface/modules directory to remove any potentially compromised cached modules and enforce strict network policies that restrict access to untrusted model repositories. Additionally, implementing file integrity monitoring on cache directories can help detect unauthorized writes early. Long-term resilience requires adopting a zero-trust approach for dynamic code loading, ensuring that all external dependencies are vetted before being written to disk, thereby preventing the inversion of security controls and maintaining the integrity of the machine learning development environment.