CVE-2026-80047: Hugging Face Transformers - Unauthorized File Write Vulnerability
Summary
CVE-2026-80047: Hugging Face Transformers downloads custom generation code before trust consent. Affects transformers versions >= 4.49.0, <= 5.8.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hugging Face Transformers is a popular open-source library that provides state-of-the-art machine learning models for natural language processing tasks. It allows users to easily download and utilize pre-trained models for various applications, including text generation, translation, and sentiment analysis. The library is widely used in both research and production environments due to its flexibility and extensive model support. However, a recent vulnerability has been identified that compromises the security model of the library, allowing unauthorized file writes to the local disk.
Vulnerability Detail
A vulnerability in Hugging Face Transformers (versions 4.49.0 to 5.8.1) allows remote Python files to be written to the local disk without user consent when using the GenerativePreTrainedModel.load_custom_generate() function. This function fetches and caches a remote module file before performing the required trust_remote_code consent check, which inverts the security model enforced by other code-loading paths. As a result, attacker-controlled Python code from custom_generate/generate.py can be copied into the user's ~/.cache/huggingface/modules directory even if the user declines the trust prompt. Although execution is gated correctly, the file write is irreversible and can persist across sessions, leading to unauthorized files on disk and potential stale cache collisions during trusted model loads. The issue originates from an unconditional file write in dynamic_module_utils.py prior to any trust verification.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the load_custom_generate() function until you can update to a patched version. Additionally, regularly clear the ~/.cache/huggingface/modules directory to remove any potentially malicious files.
Conclusion
The Hugging Face Transformers library has a significant vulnerability that allows unauthorized file writes to the local disk. Users are strongly advised to update to a patched version to mitigate the risks associated with this issue. Regular monitoring and clearing of cache directories can help reduce exposure until an update can be applied.
See every vulnerability recorded for transformers →
FAQ
The vulnerability affects Hugging Face Transformers versions 4.49.0 to 5.8.1.
If you cannot update the package, refrain from using the load_custom_generate() function and clear the cache directory regularly.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without any signup.
The risks include unauthorized file writes to the local disk, which can lead to persistent malicious files and potential execution of attacker-controlled code.
The CVSS score for this vulnerability is 7.8, indicating a high level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for transformers.
