A dangerous vulnerability has been found in Hugging Face Transformers that can allow malicious AI models to plant Python scripts on users’ systems before the user even consents to remote code execution. The flaw—labelled CVE-2026-80047—affects Transformers versions 4.49.0 through 5.8.1. It stems from how custom generation modules are loaded from model repositories. This has serious implications for AI developers, researchers, and anyone running untrusted models.
What the vulnerability does
The issue lies in the load_custom_generate() function, which is meant to help load custom text-generation logic from external model repositories. When users load a model that includes a custom_generate/generate.py file, Transformers immediately fetches the file remotely and saves it locally using get_cached_module_file() without first asking whether the user trusts the remote code.
The usual safety mechanism in Hugging Face—trust_remote_code—is designed to block execution of arbitrary scripts unless the user explicitly agrees. However, in this case, the file gets copied into the local cache directory (usually ~/.cache/huggingface/modules) before the trust prompt shows. Even if the user rejects the prompt, the file stays on disk. That violates the security expectations upheld by other Transformers components like AutoConfig, AutoModel, and AutoTokenizer.
Why it matters
Many users reuse cache directories, especially in environments like shared notebooks, CI/CD pipelines, server clusters, or persistent container volumes. That means a malicious script left in the cache could be triggered later unintentionally when a trusted model is loaded. All it takes is one unvetted model repository with a generate.py file. No administrator permissions or further interaction beyond the initial model load are necessary to get that file planted.
As of today, there’s no official patch or advisory available. Until one arrives, users are urged to avoid loading custom generation logic from repositories they don’t fully trust. Also, administrators should routinely inspect ~/.cache/huggingface/modules for suspicious files and consider clearing the cache in shared environments.
Recommendations and next steps
– Avoid calling load_custom_generate() on untrusted external model repos.
– Regularly clear module cache directories if you’re in a shared or persistent storage setup.
– Ensure any check for remote-code consent happens *before* any download or local writing of Python files.
– Stay tuned for a patch or official advisory from Hugging Face.
This vulnerability was reported by researcher Prasanna Dabi, and the issue has been documented by the CERT/CC on September 1, 2026, with vendor status still listed as unknown.
What this means: AI frameworks are increasingly complex, and trust boundaries are harder to enforce than ever. This flaw illustrates how a single function in a model-loading pipeline can undermine the trust model entirely. Going forward, users and developers should treat “trust remote code” flags not as optional prompts but as critical control points that must precede any external action. Watch for the upcoming fix—because until then, the cache directory might already be compromised without your knowledge.
