CVE-2026-80047: Hugging Face Transformers Allows Unauthorized File Write Before Trust Consent
Summary
CVE-2026-80047: Hugging Face Transformers downloads custom generation code before trust consent. Affects transformers versions >= 4.49.0, <= 5.8.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hugging Face Transformers is a widely-used library for natural language processing that provides pre-trained models and tools for generating text. It allows developers to easily implement state-of-the-art machine learning models in their applications. However, certain versions of this library have a vulnerability that compromises user trust and security by allowing unauthorized file writes.
Vulnerability Detail
A vulnerability in Hugging Face Transformers (versions 4.49.0 to 5.8.1) allows remote Python files to be written to the local disk without user consent when using the GenerativePreTrainedModel.load_custom_generate() function. This function fetches and caches a remote module file before performing the required trust_remote_code consent check, which inverts the expected security model. As a result, attacker-controlled Python code can be copied into the user's cache directory even if the user declines the trust prompt. Although the execution of this code is gated, the file write is irreversible and can persist across sessions, leading to unauthorized files on disk and potential stale cache collisions during trusted model loads. The issue arises from an unconditional file write in dynamic_module_utils.py prior to any trust verification.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the GenerativePreTrainedModel.load_custom_generate() function until you can update to a secure version. Additionally, regularly clear your cache directory located at ~/.cache/huggingface/modules to remove any unauthorized files.
Conclusion
The vulnerability identified as CVE-2026-80047 in Hugging Face Transformers poses a significant risk by allowing unauthorized file writes without user consent. It is crucial for users to update to the latest version of the library to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for transformers →
FAQ
The vulnerability affects Hugging Face Transformers versions 4.49.0 through 5.8.1.
The risks include unauthorized file writes to the user's disk, which can lead to persistent malicious code and potential execution during trusted model loads.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software by analyzing the Pipfile.lock.
References
Related vulnerabilities
Recent vulnerabilities recorded for transformers.
