CVE-2026-80047: Hugging Face Transformers arbitrary file write via load_custom_generate

CVE-2026-80047 · Severity: high · CVSS 7.8 · Published 2026-09-01

Hugging Face Transformers is a popular machine learning framework used to load and run AI models for natural language processing, computer vision, and other tasks. A vulnerability in versions 4.49.0 to 5.8.1 allows attackers to write malicious Python files to a user's cache directory without permission when loading untrusted models, even if the user declines a trust prompt. Although the malicious code won't execute immediately, the persistent unauthorized files can be reused in future model loads, potentially leading to code execution and data compromise.

Technologies: Hugging Face Transformers, transformers (PyPI). Vendors: Hugging Face, PyPI.

Quick answers

Is CVE-2026-80047 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-80047 being exploited in the wild.
How severe is CVE-2026-80047?
High severity, with a CVSS score of 7.8, published 1 September 2026.
Which products and versions are affected?
Hugging Face Transformers 4.49.0 to 5.8.1; transformers (PyPI) >= 4.49.0, <= 5.8.1, ECOSYSTEM:introduced=4.49.0,last_affected=5.8.1.
Is there a fix for CVE-2026-80047?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-80047 attacked?
It is attacked over the network.
Am I affected by CVE-2026-80047?
Check whether you run Hugging Face Transformers or transformers (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a file write authorization bypass vulnerability in the GenerativePreTrainedModel.load_custom_generate() method. The vulnerable code path fetches and caches remote Python modules via get_cached_module_file() before evaluating the trust_remote_code consent check via resolve_trust_remote_code(), inverting the security model used by other code-loading paths (AutoConfig, AutoModel, AutoTokenizer, AutoImageProcessor). An attacker can publish a model repository with a malicious custom_generate/generate.py file; when a user attempts to load the model, the malicious file is unconditionally written to ~/.cache/huggingface/modules regardless of whether the user approves or declines the trust prompt. Although code execution is correctly gated, the file write persists across sessions and can cause cache collisions where stale attacker code is later executed during trusted model loads. The root cause is an unconditional file copy operation in dynamic_module_utils.py that occurs prior to consent verification and cannot be rolled back.

Affected products

  • Hugging Face Transformers 4.49.0 to 5.8.1

Identifiers

  • CVE-2026-80047
  • GHSA-x9r9-c232-4q39
  • PYSEC-2026-4174

Timeline

  • 2026-09-01: disclosed
  • 2026-09-01: advisory: CERT VU#456290 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.