Hugging Face Transformers Vulnerability Allows Malicious AI Models to Plant Code
A flaw in Hugging Face Transformers (CVE-2026-80047) enables malicious AI models to write Python files to user systems before consent for remote code execution is granted.
A critical vulnerability, identified as CVE-2026-80047, has been discovered in the widely-used Hugging Face Transformers library, versions 4.49.0 through 5.8.1. This flaw allows malicious AI models hosted on Hugging Face repositories to write arbitrary Python files to a user's local cache directory before the user has explicitly approved the execution of remote code. The vulnerability exploits a weakness in the library's custom generation loading process, potentially exposing developer workstations, research environments, and production machine learning pipelines to untrusted code.
The core of the issue lies within the GenerativePreTrainedModel.load_custom_generate() function. When a user attempts to load a model that includes a custom generate.py file within its repository, the Transformers library fetches this file and stores it in the local Hugging Face module cache via get_cached_module_file(). Crucially, this file write operation occurs before the library verifies the user's consent for trust_remote_code. While the subsequent prompt is intended to gate arbitrary code execution, the malicious Python file has already been written to disk by this point.
This behavior deviates from other dynamic module-loading functions within the Transformers library, such as AutoConfig, AutoModel, and AutoTokenizer, which correctly validate trust_remote_code prior to downloading or writing any remote Python modules. The affected custom generation workflow bypasses this essential security check, creating a potential backdoor for malicious code injection. Even if a user declines the trust_remote_code prompt, the attacker-controlled Python content remains in the Hugging Face cache directory (typically ~/.cache/huggingface/modules), posing a latent risk.
An attacker could exploit this vulnerability by publishing a model repository containing a malicious custom_generate/generate.py file. Any user attempting to load this model reference through the vulnerable function could inadvertently trigger the local file write without requiring administrator privileges or additional interaction beyond the initial model load. The risk is amplified in environments where Hugging Face cache directories are shared or persistent, such as in CI/CD pipelines, shared cloud notebooks, or containerized ML environments.
While no official patch or advisory from Hugging Face was immediately available at the time of disclosure, security researchers and CERT/CC have highlighted the severity of the flaw. Users are strongly advised to avoid calling load_custom_generate() on untrusted Hugging Face model repositories. Furthermore, organizations utilizing shared ML infrastructure should consider regularly clearing the ~/.cache/huggingface/modules directory to mitigate the risk of previously cached malicious code being executed.
Until a permanent fix is released, developers and security teams should implement stricter validation processes. This includes ensuring that remote code consent checks are performed *before* any remote download or local file write operations are initiated. The vulnerability was reported by security researcher Prasanna Dabi and documented by CERT/CC, underscoring the ongoing challenges in securing the rapidly evolving AI development ecosystem.
The potential impact ranges from the compromise of individual developer workstations to the disruption of critical ML pipelines and the potential exfiltration of sensitive data or intellectual property. The ease with which malicious code can be placed on a system, even if not immediately executed, presents a significant supply chain risk for the AI community.