Overview
A vulnerability in the Hugging Face Transformers library (versions 4.57.0 to 5.16.1) allows remote, attacker‑controlled Python files to be written to the local disk without user authorization. The library performs a remote module fetch and local cache write before evaluating the trust_remote_code consent prompt, violating the security contract enforced across other dynamic module-loading paths in the library.
Description
Hugging Face Transformers serves as a primary framework for defining and operating modern machine learning models including NLP, computer vision, audio, video, and multimodal systems, for both training and inference. As detailed in CVE‑2026‑80047, affected versions (4.57.0 to 5.16.1) implement GenerativePreTrainedModel.load_custom_generate() such that the library fetches and caches a remote Python module via get_cached_module_file() before evaluating user consent by resolve_trust_remote_code(). Although execution of the module is correctly gated, the initial file write is unconditional. As a result, remote code from a repository’s custom_generate/generate.py is copied into ~/.cache/huggingface/modules regardless of whether the user ultimately approves or declines the trust prompt. This behavior differs from other remote code-loading mechanisms in the Transformers library (including AutoConfig, AutoModel, AutoTokenizer, and AutoImageProcessor), all of which perform trust_remote_code verification before fetching or writing any remote Python content. The root cause is an unconditional file copy operation in dynamic_module_utils.py that occurs prior to consent evaluation and cannot be rolled back. An attacker may publish a model repository containing a malicious custom_generate/generate.py file. Any downstream user who loads the model reference triggers the file‑write behavior without requiring elevated privileges or additional interaction beyond the initial load attempt.
Impact
The vulnerability results in persistent unauthorized Python files being written to the user’s local module cache. This content remains on the disk even if the user declines the trust prompt. In environments where cache paths are reused, previously written attacker files may be served later during trusted model loads, which could enable unintended execution of cached code.
Solution
This vulnerability has been fixed in version 5.17.0. It is recommended that all users update to the latest version of the Hugging Face Transformers library.
Acknowledgements
Thank you to Prasanna Dabi for reporting this vulnerability. This document was written by Bob Kemerer.
Vendor Information
References
Other Information
| CVE IDs: | CVE-2026-80047 |
| API URL: | VINCE JSON | CSAF |
| Date Public: | 2026-09-01 |
| Date First Published: | 2026-09-01 |
| Date Last Updated: | 2026-09-24 15:30 UTC |
| Document Revision: | 4 |