A newly disclosed vulnerability in Hugging Face Transformers could allow malicious AI model repositories to place attacker-controlled Python files on a user’s system before the user approves remote code execution.
Tracked as CVE-2026-80047, the issue affects Hugging Face Transformers versions 4.49.0 through 5.8.1. The flaw lies in the library’s custom generation-loading process. It can allow remote Python code to be written to the local Hugging Face module cache without authorization.
Hugging Face Transformers is widely used to train, deploy, and run machine learning models for natural language processing, computer vision, audio, video, and multimodal AI tasks.
Because the framework is commonly integrated into developer workstations, research environments, cloud notebooks, and production ML pipelines, the vulnerability could expose a broad range of users to untrusted content from model repositories.
The issue occurs in GenerativePreTrainedModel.load_custom_generate(), which is used to load custom text-generation logic from model repositories.
When a user attempts to load a model containing a custom_generate/generate.py file, Transformers retrieves the file from the remote repository and stores it locally through get_cached_module_file().
However, the library performs this remote fetch and local cache write before checking whether the user has approved trust_remote_code.
The trust_remote_code prompt is intended to prevent a model repository from running arbitrary Python code unless the user explicitly accepts the risk.
In the vulnerable code path, execution remains gated by the consent prompt. However, the remote Python file is already copied to disk before resolve_trust_remote_code () evaluates the prompt.
Hugging Face Vulnerability
As a result, a user can decline the prompt and still end up with attacker-controlled Python content stored under the Hugging Face cache directory, typically ~/.cache/huggingface/modules. The behavior differs from other dynamic module-loading functions in the Transformers library.
Components such as AutoConfig, AutoModel, AutoTokenizer, and AutoImageProcessor validate trust_remote_code before downloading or writing remote Python modules.
The affected custom generation workflow violates that security expectation by placing the file write operation before consent verification.
An attacker could exploit the flaw by publishing a model repository with a malicious custom_generate/generate.py file. Any user loading the model reference through the affected function may trigger the local file write without requiring administrator privileges or additional interaction beyond the initial model load attempt.
The risk is greater in environments that reuse Hugging Face cache directories. A malicious file left behind in the cache could later be accessed during a trusted model load, potentially creating an unintended execution path for previously cached code.
No vendor-provided patch or advisory was available at the time of disclosure. Users should avoid calling load_custom_generate() on untrusted Hugging Face model repositories and inspect the local module cache for unexpected files.
Organizations using shared notebooks, CI/CD pipelines, ML workstations, or persistent container volumes should consider clearing ~/.cache/huggingface/modules regularly until a fix is released.
Developers should also ensure that remote-code consent checks occur before any remote download or local file write operation. Security researcher Prasanna Dabi reported the vulnerability. CERT/CC published the vulnerability record on September 1, 2026, with Hugging Face listed as having an unknown vendor status.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
The post Hugging Face Flaw Lets Malicious AI Models Plant Python Code on User Systems appeared first on Cyber Security News.