Hugging Face Transformers up to 5.8.1 Trust Verification dynamic_module_utils.py GenerativePreTrainedModel.load_custom_generate dropped privileges

Summaryinfo

A vulnerability was found in Hugging Face Transformers up to 5.8.1. It has been declared as critical. This impacts the function GenerativePreTrainedModel.load_custom_generate of the file dynamic_module_utils.py of the component Trust Verification. Executing a manipulation can lead to dropped privileges. This vulnerability appears as CVE-2026-80047. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability classified as critical was found in Hugging Face Transformers up to 5.8.1. This vulnerability affects the function GenerativePreTrainedModel.load_custom_generate of the file dynamic_module_utils.py of the component Trust Verification. The manipulation with an unknown input leads to a dropped privileges vulnerability. The CWE definition for the vulnerability is CWE-273. The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded. As an impact it is known to affect integrity, and availability. CVE summarizes:

A vulnerability in Hugging Face Transformers (versions 4.49.0, <= 5.8.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). The function fetches and caches a remote module file before performing the required trust_remote_code consent check, inverting the security model enforced by other code-loading paths (such as AutoConfig, AutoModel, and AutoTokenizer). As a result, attacker‑controlled Python code from custom_generate/generate.py is copied into the user’s ~/.cache/huggingface/modules directory even if the user declines the trust prompt. Although execution is correctly gated, the file write is not reversible and can persist across sessions. This can lead to persistent, unauthorized files on disk and stale cache collisions where cached attacker code may later be executed during trusted model loads. The issue stems from an unconditional file write in dynamic_module_utils.py prior to any trust verification.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-80047 since 08/25/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 09/01/2026). The MITRE ATT&CK project declares the attack technique as T1068.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Hugging Face

Name

• Transformers

Version

• 5.8.0
• 5.8.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion