CVE-2026-80047: Hugging Face Transformers RCE Vulnerability

CVE-2026-80047 Overview

CVE-2026-80047 is a trust-boundary vulnerability in Hugging Face Transformers affecting versions >= 4.49.0 and <= 5.8.1. The flaw resides in GenerativePreTrainedModel.load_custom_generate(), which fetches and caches a remote Python module before performing the trust_remote_code consent check. Attacker-controlled code from custom_generate/generate.py is written into ~/.cache/huggingface/modules even when the user declines the trust prompt. While execution is gated correctly, the persistent file write creates conditions for later execution during trusted model loads through stale cache collisions. The issue is categorized under [CWE-273] Improper Check for Dropped Privileges.

Critical Impact
Attacker-supplied Python files persist on disk without user consent and may be executed later when a trusted model load references the same cached module path.

Affected Products

Hugging Face Transformers >= 4.49.0
Hugging Face Transformers <= 5.8.1
Any Python environment invoking GenerativePreTrainedModel.load_custom_generate()

Discovery Timeline

2026-09-01 - CVE-2026-80047 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-80047

Vulnerability Analysis

The vulnerability inverts the security model enforced elsewhere in the Transformers library. Loading paths such as AutoConfig, AutoModel, and AutoTokenizer require an explicit trust_remote_code=True consent before any remote module is retrieved. In contrast, load_custom_generate() performs the remote fetch first and validates trust afterward. The unconditional file write occurs in dynamic_module_utils.py before any verification runs.

An attacker who publishes a malicious custom_generate/generate.py on a model repository can cause the file to be copied to the local module cache the moment a victim attempts to load the model. Even if the user declines the consent prompt, the file remains on disk and is not rolled back. Later loads of an unrelated but trusted model that resolves to the same cached module path can execute the attacker-supplied code, producing a persistence primitive tied to the cache directory.

Root Cause

The root cause is an ordering flaw: the module download and cache write in dynamic_module_utils.py occur before trust_remote_code is evaluated. The consent check gates execution but not I/O. Because the cache path is deterministic, cache collisions between untrusted and trusted model loads become exploitable.

Attack Vector

Exploitation requires a local Python process to invoke load_custom_generate() against an attacker-controlled or attacker-influenced model reference. No user interaction beyond initiating the load is required, and the file write occurs even when consent is declined. The attack succeeds under a local user's privileges and can persist across sessions until the cache is manually cleared. Full technical background is documented in the CERT Vulnerability Note VU#456290 and tracked in the Hugging Face Transformers repository.

Detection Methods for CVE-2026-80047

Indicators of Compromise

Unexpected Python files under ~/.cache/huggingface/modules/transformers_modules/ written after failed or declined model loads.
Files named generate.py inside custom_generate/ subdirectories associated with untrusted model repositories.
Recent modification timestamps on cached module files that do not correspond to any confirmed trusted model load.

Detection Strategies

Audit the Hugging Face module cache directory for files created without a corresponding user-approved trust_remote_code prompt.
Hash-compare cached generate.py files against known-good repository contents to identify tampered or unexpected modules.
Monitor Python process telemetry for transformers invocations that reference remote model IDs outside an approved allowlist.

Monitoring Recommendations

Enable file integrity monitoring on ~/.cache/huggingface/modules for all users who interact with Transformers.
Log outbound network requests from Python interpreters to huggingface.co and correlate with subsequent cache directory writes.
Alert on any execution of Python modules loaded from the Hugging Face dynamic modules cache path.

How to Mitigate CVE-2026-80047

Immediate Actions Required

Upgrade Hugging Face Transformers to a fixed version above 5.8.1 once released by the maintainers.
Clear the existing ~/.cache/huggingface/modules directory to remove any previously written untrusted files.
Restrict load_custom_generate() usage to model IDs from an approved internal allowlist.

Patch Information

The vulnerability is tracked upstream in the Hugging Face Transformers repository and documented in CERT Vulnerability Note VU#456290. Apply the maintainer-supplied fix that reorders the trust_remote_code consent check to occur before any file write in dynamic_module_utils.py.

Workarounds

Avoid calling GenerativePreTrainedModel.load_custom_generate() against untrusted model repositories until patched.
Run Transformers workloads inside ephemeral containers so that any cached files are discarded at session end.
Set the HF_HOME environment variable to a sandboxed directory that is wiped between model loads.
Enforce network egress policies that restrict model downloads to vetted repositories only.

bash

# Configuration example: clear cache and sandbox Hugging Face module storage
rm -rf ~/.cache/huggingface/modules
export HF_HOME="$(mktemp -d)"
export TRANSFORMERS_OFFLINE=1