CVE-2026-80047 Hugging Face CVE debrief

Who should care

Defenders and security teams responsible for Hugging Face Transformers deployments, especially in environments where untrusted models or custom generate functions are used, should assess exposure and prioritize remediation.

Why it matters

This vulnerability allows unauthorized file writes and potential code execution in Hugging Face Transformers deployments. Defenders should prioritize verifying and remediating this vulnerability, especially in environments where untrusted models or custom generate functions are used.

• Potential for persistent, unauthorized files on disk
• Risk of stale cache collisions where cached attacker code may later be executed during trusted model loads
• Need for verification of affected versions and remediation status
• Potential for lateral movement or privilege escalation if exploited in conjunction with other vulnerabilities

Technical summary

The vulnerability allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate() in Hugging Face Transformers (versions 4.57.0 to 5.16.1). The function fetches and caches a remote module file before performing the required trust_remote_code consent check, inverting the security model enforced by other code-loading paths. This can lead to persistent, unauthorized files on disk and stale cache collisions where cached attacker code may later be executed during trusted model loads. The issue stems from an unconditional file write in dynamic_module_utils.py prior to any trust verification, allowing attackers to write arbitrary Python code to a

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in their Hugging Face Transformers deployments, especially in environments where untrusted models or custom generate functions are used.

Recommended defensive actions

• Verify Hugging Face Transformers version and assess exposure
• Review and restrict usage of GenerativePreTrainedModel.load_custom_generate()
• Implement compensating controls to monitor and restrict file writes
• Apply vendor-provided patches or updates when available
• Review system logs for suspicious activity related to Hugging Face Transformers
• Conduct a thorough risk assessment to identify potential lateral movement or privilege escalation vectors
• Inventory and track usage of affected Hugging Face Transformers deployments

Evidence notes

The vulnerability stems from an unconditional file write in dynamic_module_utils.py prior to any trust verification. Although execution is correctly gated, the file write is not reversible and can persist across sessions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.