A newly disclosed vulnerability in the Hugging Face Transformers library can cause attacker-controlled Python code to be written to a local system before a user decides whether to trust and execute remote code.
Tracked as CVE-2026-80047 and documented in CERT Coordination Center Vulnerability Note VU#456290, the issue affects Hugging Face Transformers versions 4.49.0 through 5.8.1.
The flaw specifically impacts the GenerativePreTrainedModel.load_custom_generate() workflow used to load custom generation logic from model repositories.
Hugging Face Transformers Flaw
Hugging Face Transformers is widely used for building, training, and operating machine-learning workloads across natural-language processing, computer vision, audio, video, and multimodal AI.
Its ability to load custom code from remote model repositories provides flexibility, but requires users to explicitly approve such behavior through the trust_remote_code mechanism. In affected versions, that consent boundary is enforced too late.
CERT/CC said the vulnerable code path fetches a remote Python module and writes it to the local Hugging Face module cache before evaluating the trust_remote_code prompt.
When a model uses a custom generation implementation, Transformers retrieves custom_generate/generate.py from the model repository through the get_cached_module_file() function.
The file is then copied into the user’s local cache, typically located at ~/.cache/huggingface/modules.
Only after this download-and-write operation occurs does the library call resolve_trust_remote_code() to determine whether the user has approved execution of the remote code.
This means a user who declines the trust prompt may still have an attacker-controlled Python file persistently stored on disk. CERT/CC said the initial file write is unconditional and violates the security expectations established by other dynamic module-loading paths in the library.
Other Transformers components, including AutoConfig, AutoModel, AutoTokenizer, and AutoImageProcessor, perform remote-code trust verification before downloading or writing remote Python files locally.
The custom generation path does not follow that pattern. The root cause is an unconditional file-copy operation in dynamic_module_utils.py that happens before the consent decision and cannot be rolled back if the user rejects the prompt.
An attacker could exploit the flaw by publishing a model repository containing a malicious custom_generate/generate.py file. Any user loading that model reference via the affected functionality could trigger a local file write without elevated privileges or approval to execute.
This makes the issue particularly relevant to AI development environments in which teams test numerous public model repositories, retain shared caches, or run model-loading jobs in automated pipelines.
CERT/CC said no vendor-provided patch or advisory was available at the time of publication. Hugging Face is listed with an “Unknown” vendor status in the vulnerability note.
Mitigation
Organizations using affected Transformers releases should avoid calling load_custom_generate() with untrusted model repositories until a fix is available.
Security teams should inspect ~/.cache/huggingface/modules for unexpected Python files and clear shared Hugging Face module caches where untrusted artifacts may have been loaded.
Developers should also ensure that trust and authorization checks take place before remote content retrieval or local persistence, rather than solely before import or execution.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
