{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/456290#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nA vulnerability in the Hugging Face Transformers library (versions 4.49.0 through 5.8.1) allows remote, attacker‑controlled Python files to be written to the local disk without user authorization. The library performs a remote module fetch and local cache write before evaluating the `trust_remote_code` consent prompt, violating the security contract enforced across other dynamic module-loading paths in the library.\r\n\r\n### Description\r\nHugging Face Transformers serves as a primary framework for defining and operating modern machine learning models including NLP, computer vision, audio, video, and multimodal systems, for both training and inference. As detailed in ***CVE‑2026‑80047***, affected versions (4.49.0 through 5.8.1) implement GenerativePreTrainedModel.load_custom_generate() such that the library fetches and caches a remote Python module via `get_cached_module_file()` before evaluating user consent by `resolve_trust_remote_code()`. Although execution of the module is correctly gated, the initial file write is unconditional. As a result, remote code from a repository’s `custom_generate/generate.py` is copied into `~/.cache/huggingface/modules` regardless of whether the user ultimately approves or declines the trust prompt. This behavior differs from other remote code-loading mechanisms in the Transformers library (including AutoConfig, AutoModel, AutoTokenizer, and AutoImageProcessor), all of which perform `trust_remote_code` verification before fetching or writing any remote Python content. The root cause is an unconditional file copy operation in `dynamic_module_utils.py` that occurs prior to consent evaluation and cannot be rolled back. An attacker may publish a model repository containing a malicious `custom_generate/generate.py` file. Any downstream user who loads the model reference triggers the file‑write behavior without requiring elevated privileges or additional interaction beyond the initial load attempt.\r\n\r\n### Impact\r\nThe vulnerability results in persistent unauthorized Python files being written to the user’s local module cache. This content remains on the disk even if the user declines the trust prompt. In environments where cache paths are reused, previously written attacker files may be served later during trusted model loads, which could enable unintended execution of cached code.\r\n\r\n### Solution\r\nAt the time of writing, no vendor-provided patch or advisory is available. Users should avoid invoking `load_custom_generate()` with untrusted model repositories and periodically inspect or clear the Hugging Face module cache (`~/.cache/huggingface/modules`) to remove unexpected content. Implementations should ensure that `trust_remote_code` checks occur prior to any remote content retrieval or local file writes.\r\n\r\n### Acknowledgements\r\nThank you to Prasanna Dabi for reporting this vulnerability. This document was written by Bob Kemerer.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/456290"},{"url":"https://github.com/huggingface/transformers","summary":"https://github.com/huggingface/transformers"}],"title":"Hugging Face Transformers library writes remote code to disk prior to consent check","tracking":{"current_release_date":"2026-09-01T13:35:43+00:00","generator":{"engine":{"name":"VINCE","version":"3.0.45"}},"id":"VU#456290","initial_release_date":"2026-09-01 13:35:43.148962+00:00","revision_history":[{"date":"2026-09-01T13:35:43+00:00","number":"1.20260901133543.1","summary":"Released on 2026-09-01T13:35:43+00:00"}],"status":"final","version":"1.20260901133543.1"}},"vulnerabilities":[{"title":"A vulnerability in Hugging Face Transformers (versions 4.","notes":[{"category":"summary","text":"A vulnerability in Hugging Face Transformers (versions 4.49.0, <= 5.8.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). The function fetches and caches a remote module file before performing the required trust_remote_code consent check, inverting the security model enforced by other code-loading paths (such as AutoConfig, AutoModel, and AutoTokenizer). As a result, attacker‑controlled Python code from custom_generate/generate.py is copied into the user’s ~/.cache/huggingface/modules directory even if the user declines the trust prompt. Although execution is correctly gated, the file write is not reversible and can persist across sessions. This can lead to persistent, unauthorized files on disk and stale cache collisions where cached attacker code may later be executed during trusted model loads. The issue stems from an unconditional file write in dynamic_module_utils.py prior to any trust verification."}],"cve":"CVE-2026-80047","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#456290"}]}],"product_tree":{"branches":[]}}