CVE-2026-80047 Hugging Face CVE debrief

Who should care

Users of Hugging Face Transformers versions >= 4.49.0 and <= 5.8.1, developers and administrators working with machine learning models, and security teams responsible for monitoring and mitigating vulnerabilities in AI and ML systems.

Technical summary

The vulnerability in Hugging Face Transformers allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). The function fetches and caches a remote module file before performing the required trust_remote_code consent check, inverting the security model enforced by other code-loading paths. This can lead to persistent, unauthorized files on disk and stale cache collisions where cached attacker code may later be executed during trusted model loads.

Defensive priority

CVE-2026-80047 allows remote Python files to be written to local disk without user consent in Hugging Face Transformers versions >= 4.49.0 and <= 5.8.1. This can lead to persistent, unauthorized files on disk and stale cache collisions. Immediate review and mitigation are recommended.

Recommended defensive actions

• Review and update Hugging Face Transformers to a version outside the vulnerable range (>= 4.49.0 and <= 5.8.1) if possible.
• Implement compensating controls to monitor and restrict writes to the ~/.cache/huggingface/modules directory.
• Enforce strict trust_remote_code checks for all model loads.
• Monitor for and remove any unauthorized files in the ~/.cache/huggingface/modules directory.
• Consider using alternative model loading methods that do not rely on remote module fetching.

Evidence notes

The vulnerability stems from an unconditional file write in dynamic_module_utils.py prior to any trust verification in Hugging Face Transformers. GenerativePreTrainedModel.load_custom_generate() fetches and caches a remote module file before performing the required trust_remote_code consent check. This results in attacker-controlled Python code being copied into the user’s ~/.cache/huggingface/modules directory even if the user declines the trust prompt.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.