Executive brief
Hugging Face Transformers is a popular machine learning framework used to load and run AI models for natural language processing, computer vision, and other tasks. A vulnerability in versions 4.49.0 to 5.8.1 allows attackers to write malicious Python files to a user's cache directory without permission when loading untrusted models, even if the user declines a trust prompt. Although the malicious code won't execute immediately, the persistent unauthorized files can be reused in future model loads, potentially leading to code execution and data compromise.
Technical details
This is a file write authorization bypass vulnerability in the GenerativePreTrainedModel.load_custom_generate() method. The vulnerable code path fetches and caches remote Python modules via get_cached_module_file() before evaluating the trust_remote_code consent check via resolve_trust_remote_code(), inverting the security model used by other code-loading paths (AutoConfig, AutoModel, AutoTokenizer, AutoImageProcessor). An attacker can publish a model repository with a malicious custom_generate/generate.py file; when a user attempts to load the model, the malicious file is unconditionally written to ~/.cache/huggingface/modules regardless of whether the user approves or declines the trust prompt. Although code execution is correctly gated, the file write persists across sessions and can cause cache collisions where stale attacker code is later executed during trusted model loads. The root cause is an unconditional file copy operation in dynamic_module_utils.py that occurs prior to consent verification and cannot be rolled back.
Affected products
- Hugging Face Transformers 4.49.0 to 5.8.1
Timeline
- 2026-09-01: disclosed
- 2026-09-01: advisory: CERT VU#456290 published