CVE-2026-80047: Transformers remote file write

Q: Is CVE-2026-80047 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-80047, increasing the risk of exploitation.

Q: How to fix CVE-2026-80047?

Upgrade Hugging Face Transformers to a version outside the affected range (>=4.49.0, <=5.8.1) as soon as the fix is available; track the vendor advisory at kb.cert.org/vuls/id/456290 and the GitHub repo for the patched release. Until patched, avoid using load_custom_generate() against any model repository that is not fully trusted and version-pinned. Proactively audit ~/.cache/huggingface/modules on hosts that load community models, and treat any custom_generate module present after a declined trust_remote_code prompt as a compromise indicator requiring manual review and removal. Consider running model-loading workflows in ephemeral, isolated environments (containers with disposable filesystems) so a rejected trust prompt cannot leave a persistent artifact, and add file-integrity monitoring on the Hugging Face module cache directory for CI/build and production inference hosts.

Q: What systems are affected by CVE-2026-80047?

This vulnerability affects the following AI/ML architecture patterns: model serving, agent frameworks, RAG pipelines.

Q: What is the CVSS score for CVE-2026-80047?

CVE-2026-80047 has a CVSS v3.1 base score of 7.8 (HIGH). The EPSS exploitation probability is 0.10%.

CISO Take

Hugging Face Transformers' load_custom_generate() fetches and writes an attacker-controlled Python module to disk (~/.cache/huggingface/modules) before it ever checks trust_remote_code consent, inverting the trust model that AutoConfig, AutoModel and AutoTokenizer correctly enforce. This matters because trust_remote_code is the industry-standard safeguard teams rely on to gate arbitrary code execution when loading community models, and here declining the prompt does nothing — the malicious file is already persisted and can collide with a later, genuinely trusted load. There is no CVSS score, no CISA KEV listing, no EPSS data and no public exploit or scanner template yet, so this is not an actively-weaponized flaw today, but Transformers underpins a huge share of the open-source AI/ML supply chain, which raises the blast radius if this pattern is copied elsewhere. Upgrade past the affected range (>=4.49.0, <=5.8.1) as soon as a patched release is available, and in the meantime audit ~/.cache/huggingface/modules for unexpected files and treat any presence there from a declined-trust session as a tampering indicator. Avoid calling load_custom_generate() against untrusted or unverified model repositories until patched.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

No CVSS vector, EPSS score, or KEV listing exists yet, and there is no public exploit or Nuclei template, so near-term mass exploitation is unlikely. However, the flaw undermines a foundational security control (trust_remote_code) that the entire Hugging Face ecosystem depends on to gate code execution from untrusted model repositories, which elevates its strategic risk beyond what an unscored CVE would normally suggest. The write-before-consent ordering means the vulnerability is exploitable simply by getting a victim to attempt to load a malicious model — no successful trust-prompt acceptance is required, only a file-system write, with code execution deferred to a later stale-cache collision. Given Transformers' enormous downstream footprint (tracked here as an ai_agent-relevant, high-adoption ML library), even a low-complexity, non-scored flaw like this warrants prioritized patching over routine backlog treatment.

How does the attack unfold?

Staging

Adversary publishes a model repository to the Hugging Face Hub containing a malicious custom_generate/generate.py.

AML.T0058

Trust Bypass

Victim calls load_custom_generate(), triggering Transformers to fetch and write the remote module to the local module cache before any trust_remote_code consent check occurs.

AML.T0010.001

Persistence

Victim declines the trust prompt, but the malicious module remains permanently cached on disk in ~/.cache/huggingface/modules.

AML.T0011.000

Execution Impact

A later, legitimately-trusted model load collides with the stale cached module path and silently executes the attacker's code.

AML.T0050

Staging

Adversary publishes a model repository to the Hugging Face Hub containing a malicious custom_generate/generate.py.

AML.T0058

Trust Bypass

Victim calls load_custom_generate(), triggering Transformers to fetch and write the remote module to the local module cache before any trust_remote_code consent check occurs.

AML.T0010.001

Persistence

Victim declines the trust prompt, but the malicious module remains permanently cached on disk in ~/.cache/huggingface/modules.

AML.T0011.000

Execution Impact

A later, legitimately-trusted model load collides with the stale cached module path and silently executes the attacker's code.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Transformers	pip	>= 4.49.0, <= 5.8.1	No patch
168.4KOpenSSF 6.69.8K dependentsPushed yesterday42% patched~89d to patchFull package profile →

Do you use Transformers? You're affected.

How severe is it?

CVSS 3.1

7.8 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 1% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVLocal

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

Upgrade Hugging Face Transformers to a version outside the affected range (>=4.49.0, <=5.8.1) as soon as the fix is available; track the vendor advisory at kb.cert.org/vuls/id/456290 and the GitHub repo for the patched release. Until patched, avoid using load_custom_generate() against any model repository that is not fully trusted and version-pinned. Proactively audit ~/.cache/huggingface/modules on hosts that load community models, and treat any custom_generate module present after a declined trust_remote_code prompt as a compromise indicator requiring manual review and removal. Consider running model-loading workflows in ephemeral, isolated environments (containers with disposable filesystems) so a rejected trust prompt cannot leave a persistent artifact, and add file-integrity monitoring on the Hugging Face module cache directory for CI/build and production inference hosts.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply ChainCode ExecutionAuth BypassFrameworkModelAML.T0010.001- AI Software AML.T0011.000- Unsafe AI Artifacts AML.T0058- Publish Poisoned Models

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2.4-AI System Security Controls

NIST AI RMF

GOVERN-6.1-Third-Party and Supply Chain Risk Management

OWASP LLM Top 10

LLM03-Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-80047?

Hugging Face Transformers' load_custom_generate() fetches and writes an attacker-controlled Python module to disk (~/.cache/huggingface/modules) before it ever checks trust_remote_code consent, inverting the trust model that AutoConfig, AutoModel and AutoTokenizer correctly enforce. This matters because trust_remote_code is the industry-standard safeguard teams rely on to gate arbitrary code execution when loading community models, and here declining the prompt does nothing — the malicious file is already persisted and can collide with a later, genuinely trusted load. There is no CVSS score, no CISA KEV listing, no EPSS data and no public exploit or scanner template yet, so this is not an actively-weaponized flaw today, but Transformers underpins a huge share of the open-source AI/ML supply chain, which raises the blast radius if this pattern is copied elsewhere. Upgrade past the affected range (>=4.49.0, <=5.8.1) as soon as a patched release is available, and in the meantime audit ~/.cache/huggingface/modules for unexpected files and treat any presence there from a declined-trust session as a tampering indicator. Avoid calling load_custom_generate() against untrusted or unverified model repositories until patched.

Is CVE-2026-80047 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-80047, increasing the risk of exploitation.

How to fix CVE-2026-80047?

Upgrade Hugging Face Transformers to a version outside the affected range (>=4.49.0, <=5.8.1) as soon as the fix is available; track the vendor advisory at kb.cert.org/vuls/id/456290 and the GitHub repo for the patched release. Until patched, avoid using load_custom_generate() against any model repository that is not fully trusted and version-pinned. Proactively audit ~/.cache/huggingface/modules on hosts that load community models, and treat any custom_generate module present after a declined trust_remote_code prompt as a compromise indicator requiring manual review and removal. Consider running model-loading workflows in ephemeral, isolated environments (containers with disposable filesystems) so a rejected trust prompt cannot leave a persistent artifact, and add file-integrity monitoring on the Hugging Face module cache directory for CI/build and production inference hosts.

What systems are affected by CVE-2026-80047?

This vulnerability affects the following AI/ML architecture patterns: model serving, agent frameworks, RAG pipelines.

What is the CVSS score for CVE-2026-80047?

CVE-2026-80047 has a CVSS v3.1 base score of 7.8 (HIGH). The EPSS exploitation probability is 0.10%.

What is the AI security impact?

Affected AI Architectures

model servingagent frameworksRAG pipelines

MITRE ATLAS Techniques

AML.T0010.001AI Software

AML.T0011.000Unsafe AI Artifacts

AML.T0058Publish Poisoned Models

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.4

NIST AI RMF: GOVERN-6.1

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). The function fetches and caches a remote module file before performing the required trust_remote_code consent check, inverting the security model enforced by other code-loading paths (such as AutoConfig, AutoModel, and AutoTokenizer). As a result, attacker‑controlled Python code from custom_generate/generate.py is copied into the user’s ~/.cache/huggingface/modules directory even if the user declines the trust prompt. Although execution is correctly gated, the file write is not reversible and can persist across sessions. This can lead to persistent, unauthorized files on disk and stale cache collisions where cached attacker code may later be executed during trusted model loads. The issue stems from an unconditional file write in dynamic_module_utils.py prior to any trust verification.

Exploitation Scenario

An adversary publishes a model repository on the Hugging Face Hub containing a malicious custom_generate/generate.py designed to execute arbitrary code when loaded. A victim, evaluating or integrating the model into an agent or serving pipeline, calls load_custom_generate() — Transformers fetches and writes the remote module to ~/.cache/huggingface/modules before showing the trust_remote_code consent prompt. The victim declines the prompt, believing no code or data was persisted, but the malicious file remains cached indefinitely. Later, the victim (or a teammate on the same host) loads a different, legitimately trusted model that happens to reference a module with a colliding cache path, and the previously-declined attacker code executes silently under the trusted context.

Weaknesses (CWE)

CWE-273Improper Check for Dropped PrivilegesPrimary

CWE-273 — Improper Check for Dropped Privileges: The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
[Implementation] Check the results of all functions that return a value and verify that the value is expected.

Source: MITRE CWE corpus.