CVE-2026-80047: Hugging Face Transformers library writes remote code to disk prior to consent check
A vulnerability in Hugging Face Transformers (versions 4.49.0, <= 5.8.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.loadcustomgenerate(). The function fetches and caches a remote module file before performing the required trustremotecode consent check, inverting the security model enforced by other code-loading paths (such as AutoConfig, AutoModel, and AutoTokenizer). As a result, attacker‑controlled Python code from customgenerate/generate.py is copied into the user’s ~/.cache/huggingface/modules directory even if the user declines the trust prompt. Although execution is correctly gated, the file write is not reversible and can persist across sessions. This can lead to persistent, unauthorized files on disk and stale cache collisions where cached attacker code may later be executed during trusted model loads. The issue stems from an unconditional file write in dynamicmoduleutils.py prior to any trust verification.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Hugging Face Transformers versions 4.49.0 through 5.8.1 are exposed when they call GenerativePreTrainedModel.load_custom_generate() on a model whose custom_generate/generate.py is remotely supplied. Other remote-code loading paths named in the advisory, including AutoConfig, AutoModel, and AutoTokenizer, enforce consent before writing code.
Does declining the trust_remote_code prompt prevent the disk write?
No. The remote Python file is fetched and copied into ~/.cache/huggingface/modules before the trust_remote_code consent check occurs. Declining consent prevents execution at that time, but does not remove the cached file.
What is the practical impact if the code is not executed immediately?
The attacker-controlled file can persist in the local Hugging Face modules cache across sessions. A stale cache collision can cause that cached code to be executed later during a trusted model load.
How can I determine whether a system may already be affected?
Review uses of GenerativePreTrainedModel.load_custom_generate() and inspect ~/.cache/huggingface/modules for cached remote module files associated with models that prompted for, or were denied, remote-code trust. A file may remain present even where the user declined the prompt.