CISA includes advisory on Transformers CVE-2026-80047 disk writes prior to consent

A vulnerability in the Hugging Face Transformers library affects versions 4.49.0 through 5.8.1 and allows remote, attacker-controlled Python files to be written to the local disk without user authorization, even though module execution is gated. The highest-level impact is persistent unauthorized file writes to the local module cache.

The issue is tracked as CVE-2026-80047. The affected versions implement GenerativePreTrainedModel.load_custom_generate() such that the library fetches and caches a remote Python module via get_cached_module_file() before evaluating the user consent prompt by resolve_trust_remote_code(). Although execution of the module is correctly gated, the initial file write is unconditional. Remote code from a repository’s custom_generate/generate.py is copied into ~/.cache/huggingface/modules regardless of whether the user approves or declines the trust prompt. This behavior differs from other remote code-loading mechanisms in Transformers, including AutoConfig, AutoModel, AutoTokenizer, and AutoImageProcessor, which perform trust_remote_code verification before fetching or writing any remote Python content. The root cause is an unconditional file copy operation in dynamic_module_utils.py that occurs prior to consent evaluation and cannot be rolled back.

The vulnerability results in persistent unauthorized Python files being written to the user’s local module cache. The content remains on disk even if the user declines the trust prompt. In environments where cache paths are reused, previously written attacker files may be served later during trusted model loads, which could enable unintended execution of cached code.

At the time of writing, no vendor-provided patch or advisory is available. The guidance is to avoid invoking load_custom_generate() with untrusted model repositories and to periodically inspect or clear the Hugging Face module cache (~/.cache/huggingface/modules) to remove unexpected content. Implementations should ensure that trust_remote_code checks occur prior to any remote content retrieval or local file writes.

Thanks are provided to Prasanna Dabi for reporting this vulnerability, and the document states that it was written by Bob Kemerer. References include the Hugging Face Transformers GitHub repository at https://github.com/huggingface/transformers, and the advisory lists CVE-2026-80047 with the public date of 2026-09-01 and first published date of 2026-09-01.

Blog post, originally published at kb.cert.org.