Do Son 
TL;DR
A Hugging Face vulnerability writes unverified Python files to local disks before checking user permissions. Specifically, this flaw affects the Transformers library versions 4.49.0 through 5.8.1. Attackers can therefore cache malicious code merely when users load compromised models.
- CVE: CVE-2026-80047
- CVSS: Awaiting analysis
- Product: Hugging Face Transformers
- Affected: 4.49.0
- Impact: Hugging Face Transformers library writes remote code to disk prior to consent check
- Status: No confirmed exploitation yet
- Action: See vendor advisory
Why It Matters
Developers currently rely heavily on the Transformers library for machine learning tasks. However, unauthorized code remains in the user cache even if they reject the prompt. Reused cache paths might execute these attacker files later. Consequently, this creates a severe risk for teams training or running models.
How the Attack Works
The library fetches remote modules before evaluating the user consent prompt. The get_cached_module_file() function executes first. As noted in the advisory, “remote code from a repository’s custom_generate/generate.py is copied into ~/.cache/huggingface/modules regardless of whether the user ultimately approves or declines the trust prompt.” First, an attacker uploads a malicious model repository. Any user loading this model triggers the local file write. This surprisingly happens without elevated privileges. Ultimately, the flaw stems from an unconditional file copy operation. This operation occurs before the trust verification runs.
Affected Versions
This Hugging Face vulnerability impacts Transformers library versions 4.49.0 through 5.8.1. Additionally, researchers detailed this problem in a recent document. It is named Hugging Face Transformers library writes remote code to disk prior to consent check.pdf. Fortunately, no public proof-of-concept exists currently. Experts have not confirmed any exploitation in the wild. Exact installation counts remain unknown.
Patch or Mitigation Steps
Vendors have unfortunately not released a patch yet. Users must therefore avoid loading models from untrusted repositories. You should inspect the module cache frequently. Delete any unexpected files from the local directory immediately.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
