VulnSocial

CVE-2026-80047Disclosure

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). The function fetches and caches a remote module file before performing the required trust_remote_code consent check, inverting the security model enforced by other code-loading paths (such as AutoConfig, AutoModel, and AutoTokenizer). As a result, attacker‑controlled Python code from custom_generate/generate.py is copied into the user’s ~/.cache/huggingface/modules directory even if the user declines the trust prompt. Although execution is correctly gated, the file write is not reversible and can persist across sessions. This can lead to persistent, unauthorized files on disk and stale cache collisions where cached attacker code may later be executed during trusted model loads. The issue stems from an unconditional file write in dynamic_module_utils.py prior to any trust verification.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-273CWE-367CWE-494

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-09-01); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-01: 1Mentions · 2026-09-02: 1Technical Details · 2026-09-01: 1Technical Details · 2026-09-02: 109-0109-02
Signal classification1 categories
Disclosure
2100.0%
Referenced assets4 URLs
Full discourse2 posts
  • Daily CyberSecurity@Daily_CyberSec
    Disclosure

    A new Hugging Face vulnerability (CVE-2026-80047) writes remote Python code to disk before user consent. Learn how to protect your machine learning models. #HuggingFace #CyberSecurity #Vulnerability #MachineLearning #CVE202680047 https://securityonline.info/hugging-face-vulnerability/

    Post summary

    The text announces Hugging Face CVE-2026-80047, describes how it permits remote Python code to be written to disk without user consent, and offers general protection advice.

    00010443
    12.9K followersView on X
  • OJOBIT@0J0BIT
    Disclosure

    CVE-2026-80047 lets Transformers 4.49.0 through 5.8.1 write an attacker-controlled Python file to the module cache before trustremotecode consent is evaluated. CVE-2026-80047 in Transformers 4.49.0-5.8.1 lets loadcustomgenerate() write a remote http://generate.py to the local module cache before trustremotecode consent is checked. Transformers 4.49.0 through 5.8.1 writes an attacker-controlled Python file to ~/.cache/huggingface/modules before asking whether remote code should be trusted, and a decline still leaves that file on disk. CERT/CC published the flaw as VU#456290, assigned CVE-2026-80047, from a report by Prasanna Dabi; Bob Kemerer wrote the advisory. Move consent ahead of retrieval in dynamicmodule_utils.py, matching every other loader in the library, and until that lands, treat the Hugging Face module cache as untrusted input. CERT/CC reports the file persists even if the user declines, with no patch available yet. https://news.ojobit.com/story/hugging-face-transformers-remote-code-disk-before-consent-cba6cf

    Post summary

    The advisory details a vulnerability in Hugging Face Transformers that allows attacker-controlled Python files to be written to the module cache before remote‑code consent is obtained, exposing potential remote code execution risks, but no patch or exploit code is available yet.

    0000035
    17 followersView on X

Explore more

Back to dashboard