Hugging Face Transformers writes untrusted files pre-consent

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

A flaw in Hugging Face Transformers writes attacker-controlled Python files to disk before the trust_remote_code consent check runs.

Sourcekb.cert.org — open the original

CERT/CC has published an advisory (VU#456290) for CVE-2026-80047, a vulnerability affecting the Hugging Face Transformers library versions 4.49.0 through 5.8.1. The flaw stems from GenerativePreTrainedModel.load_custom_generate(), which calls get_cached_module_file() to fetch and cache a remote Python module before resolve_trust_remote_code() evaluates user consent. This means a malicious custom_generate/generate.py file from an attacker-controlled model repository is written unconditionally to ~/.cache/huggingface/modules regardless of whether the user approves or declines the trust prompt, breaking the security contract that other dynamic module-loading paths (AutoConfig, AutoModel, AutoTokenizer, AutoImageProcessor) correctly enforce.

While the module's execution is still gated by the trust prompt, the persistent file write itself is unauthorized and cannot be rolled back. In environments where cache paths are reused across sessions or users, previously written attacker-controlled files could later be served during a legitimately trusted model load, potentially enabling unintended code execution. Exploitation requires no elevated privileges beyond a normal model load attempt, making this relevant to any ML pipeline or developer environment that loads models from untrusted or third-party Hugging Face repositories.

At the time of publication, no vendor patch is available. CERT/CC recommends avoiding load_custom_generate() with untrusted repositories, periodically inspecting or clearing the local module cache directory, and ensuring trust_remote_code validation occurs prior to any remote content retrieval or file write in custom implementations. There is no indication in the advisory of in-the-wild exploitation; this is a disclosed design flaw rather than an observed attack campaign.

title: Hugging Face Transformers Unauthorized Module Cache Write
description: Detects writes to Hugging Face module cache (~/.cache/huggingface/modules)
  by Python processes, potentially indicating CVE-2026-80047 exploitation where malicious
  custom_generate.py or other modules are cached before user trust consent is evaluated.
tags:
- attack.t1574
logsource:
  category: file_event
  product: windows
detection:
  selection_cache_write:
    TargetFilename|contains:
    - \.cache\huggingface\modules
    - \AppData\Local\huggingface\modules
    Image|endswith:
    - \python.exe
    - \python3.exe
  selection_suspicious_extensions:
    TargetFilename|endswith:
    - .py
    - .pyc
    - .pyd
  filter_legitimate_huggingface:
    CommandLine|contains:
    - trust_remote_code=True
    - trust_remote_code=true
  condition: selection_cache_write and selection_suspicious_extensions and not filter_legitimate_huggingface
falsepositives:
- Legitimate Hugging Face model loads with trust_remote_code explicitly enabled by
  the user
- Development environments where developers intentionally inspect or cache modules
level: medium
id: 3ac560ed-f4ec-5b5d-a548-b1f051a2cbbd
status: experimental
author: Vorant

title: Hugging Face Transformers load_custom_generate Execution Without Trust Consent
description: Detects Python code execution calling GenerativePreTrainedModel.load_custom_generate()
  or get_cached_module_file() without trust_remote_code=True argument, typical of
  CVE-2026-80047 exploitation where malicious modules are cached before consent is
  requested.
tags:
- attack.t1195.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_python_transformers:
    Image|endswith:
    - \python.exe
    - \python3.exe
    CommandLine|contains:
    - load_custom_generate
    - get_cached_module_file
  filter_trust_enabled:
    CommandLine|contains:
    - trust_remote_code=True
    - trust_remote_code=true
    - trust_remote_code = True
  condition: selection_python_transformers and not filter_trust_enabled
falsepositives:
- Development or testing environments where trust_remote_code is set via environment
  variable or configuration file rather than command-line argument
- Legacy code that relies on outdated Hugging Face API patterns
level: low
id: a864cc97-b2ed-5eb3-98c8-46cfaec519ce
status: experimental
author: Vorant

Source reporting: https://kb.cert.org/vuls/id/456290

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.