Remote Code Execution Vulnerability in Hugging Face Transformers

CVE-2026-80047

What is CVE-2026-80047?

A security flaw in Hugging Face Transformers versions 4.49.0 and 5.8.1 or earlier allows remote Python files to be written to a user's local disk without consent. This occurs via the GenerativePreTrainedModel.load_custom_generate() function, which improperly fetches and caches remote module files before conducting a trust check. This lapse in security leads to potentially malicious Python code being stored in the ~/.cache/huggingface/modules directory, even if users reject the trust approval. Although the execution of the code can be controlled, the initial file writes are irreversible and can create persistent unauthorized files that survive across sessions and may lead to conflicts with cached data during subsequent model operations.

References