# CVE-2026-80047: Hugging Face Transformers arbitrary file write via load_custom_generate

Source: https://junglewise.ai/threats/cve-2026-80047-hugging-face-transformers-arbitrary-file-write-via-load-custom  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-80047 · Severity: high · CVSS 7.8 · Published 2026-09-01

Hugging Face Transformers is a popular machine learning framework used to load and run AI models for natural language processing, computer vision, and other tasks. A vulnerability in versions 4.49.0 to 5.8.1 allows attackers to write malicious Python files to a user's cache directory without permission when loading untrusted models, even if the user declines a trust prompt. Although the malicious code won't execute immediately, the persistent unauthorized files can be reused in future model loads, potentially leading to code execution and data compromise.

Technologies: [Hugging Face Transformers](https://junglewise.ai/threats/technologies/transformers), [transformers (PyPI)](https://junglewise.ai/threats/technologies/pypi-transformers). Vendors: [Hugging Face](https://junglewise.ai/threats/vendors/hugging-face), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-80047 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-80047 being exploited in the wild.

**How severe is CVE-2026-80047?** High severity, with a CVSS score of 7.8, published 1 September 2026.

**Which products and versions are affected?** Hugging Face Transformers 4.49.0 to 5.8.1; transformers (PyPI) >= 4.49.0, <= 5.8.1, ECOSYSTEM:introduced=4.49.0,last_affected=5.8.1.

**Is there a fix for CVE-2026-80047?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-80047 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-80047?** Check whether you run Hugging Face Transformers or transformers (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a file write authorization bypass vulnerability in the GenerativePreTrainedModel.load_custom_generate() method. The vulnerable code path fetches and caches remote Python modules via get_cached_module_file() before evaluating the trust_remote_code consent check via resolve_trust_remote_code(), inverting the security model used by other code-loading paths (AutoConfig, AutoModel, AutoTokenizer, AutoImageProcessor). An attacker can publish a model repository with a malicious custom_generate/generate.py file; when a user attempts to load the model, the malicious file is unconditionally written to ~/.cache/huggingface/modules regardless of whether the user approves or declines the trust prompt. Although code execution is correctly gated, the file write persists across sessions and can cause cache collisions where stale attacker code is later executed during trusted model loads. The root cause is an unconditional file copy operation in dynamic_module_utils.py that occurs prior to consent verification and cannot be rolled back.

## Affected products

- Hugging Face Transformers 4.49.0 to 5.8.1

## Identifiers

- CVE-2026-80047
- GHSA-x9r9-c232-4q39
- PYSEC-2026-4174

## Timeline

- 2026-09-01: disclosed
- 2026-09-01: advisory: CERT VU#456290 published

## References

- [https://github.com/huggingface/transformers](https://github.com/huggingface/transformers)
- [https://kb.cert.org/vuls/id/456290](https://kb.cert.org/vuls/id/456290)

## Related threats

- [Hugging Face Transformers path traversal in save_pretrained](https://junglewise.ai/threats/cve-2026-9856-hugging-face-transformers-path-traversal-in-save-pretrained)
- [Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer](https://junglewise.ai/threats/cve-2025-6921-hugging-face-transformers-vulnerable-to-regular-expression-denial)
- [PYSEC-2026-1988 - Hugging Face Transformers library has Regular Expression Denial of Service](https://junglewise.ai/threats/cve-2025-6051-hugging-face-transformers-library-has-regular-expression-denial-of)
- [PYSEC-2026-1981 - Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer](https://junglewise.ai/threats/cve-2025-6638-hugging-face-transformers-is-vulnerable-to-redos-through-its)
- [PYSEC-2026-1983 - Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability](https://junglewise.ai/threats/cve-2025-5197-hugging-face-transformers-regular-expression-denial-of-service)