CVE-2026-80047

Name of the Vulnerable Software and Affected Versions Hugging Face Transformers versions 4.49.0 through 5.8.1

Description A consent-bypass issue exists where remote Python files are written to the local disk without user consent. This occurs when using the load custom generate() function, which fetches and caches a remote module file from a repository before performing the required trust remote code consent check. This behavior inverts the security model used by other code-loading paths such as AutoConfig, AutoModel, and AutoTokenizer. Specifically, attacker-controlled Python code from custom generate/generate.py is copied into the ~/.cache/huggingface/modules directory via an unconditional file write in dynamic module utils.py prior to trust verification. While the execution of the code is gated by the consent prompt, the file write is not reversible and persists across sessions, potentially leading to unauthorized files on disk and stale cache collisions where malicious code may be executed during subsequent trusted model loads.

Recommendations Update Hugging Face Transformers to a version later than 5.8.1. Monitor writes to the ~/.cache/huggingface/modules directory for unexpected files. Restrict outbound network access from the cache directory until consent is explicitly granted.