Hugging Face Transformers flaw writes files before consent

The CERT Coordination Center (CERT/CC) published a security advisory on September 1, 2026, describing a flaw in Hugging Face Transformers, the world's most widely used Python library for loading and running AI models. Tracked as CVE-2026-80047, it affects library versions 4.49.0 through 5.8.1. Japan's vulnerability portal JVN (Japan Vulnerability Notes) published matching information the same day, first reported locally by INTERNET Watch. As of this writing, Hugging Face has issued no patch and no public statement.

Hugging Face Transformers is the Python library provided by the Hugging Face platform to load pre-trained AI models — for natural language processing, computer vision, audio, video, and multimodal systems — and run inference or further training. CERT/CC describes it as one of the most widely deployed frameworks of its kind, used across both research and production pipelines worldwide.

A file written before the question is even asked

The flaw sits in GenerativePreTrainedModel.load_custom_generate(), a function that lets a model repository supply its own custom generation logic. That function fetches the remote module through get_cached_module_file() and writes it into the user's local cache at ~/.cache/huggingface/modules — before the library evaluates user consent through resolve_trust_remote_code(), the trust_remote_code mechanism meant to gate execution of unapproved code. CERT/CC notes that execution itself is correctly blocked when a user declines; it is the initial disk write that is unconditional. The root cause is an unconditional file copy inside dynamic_module_utils.py, a behavior that differs from every other dynamic-loading path in the library — AutoConfig, AutoModel, AutoTokenizer, and AutoImageProcessor all verify consent before fetching or writing anything.

• Even if a user declines the trust prompt, the file remains in the local cache afterward
• The author of a malicious model repository can place arbitrary Python code in custom_generate/generate.py
• Simply attempting to load the model triggers the write, with no elevated privileges or extra user action required
• In environments where the cache is reused, a previously written malicious file could be served — and unintentionally executed — during a later, trusted model load

No patch yet, and a workaround instead

The flaw was reported by security researcher Prasanna Dabi. CERT/CC says it notified Hugging Face on August 4, 2026; as of the advisory's publication on September 1, the company had provided no statement, and its vendor status in the record is listed as 'Unknown.' With no fix available, both CERT/CC and JVN recommend avoiding load_custom_generate() on untrusted model repositories, and periodically inspecting the ~/.cache/huggingface/modules directory to remove any unexpected files.

CERT/CC also notes that the initial file copy cannot be rolled back once it happens: the trust_remote_code mechanism does correctly block code execution if the user declines, but nothing removes the file already written to disk. The advisory further recommends, as a general design principle, that any trust_remote_code-style check occur before any remote content is fetched or written — a requirement the affected function currently fails to meet. The library's source code is public on GitHub, where the huggingface/transformers repository remains, for now, the only official channel for tracking a fix.

The advisory credits security researcher Prasanna Dabi as the reporter and CERT/CC analyst Bob Kemerer as the document's author. Less than a month passed between the private notification of Hugging Face on August 4 and the advisory's public release on September 1 — a window during which, according to CERT/CC's coordinated-disclosure timeline, the company gave no response.

CERT/CC operates within Carnegie Mellon University's Software Engineering Institute and is sponsored by the US Cybersecurity and Infrastructure Security Agency (CISA).

Execution of the module is correctly gated, but the initial file write is unconditional — behavior that differs from other dynamic module-loading paths in the library.

What this changes for a development team

For any team building AI pipelines on Hugging Face Transformers — whether a startup, an enterprise ML platform, or a research lab — this flaw is an immediate checklist item rather than background noise. Teams should audit every call to load_custom_generate() in their codebase and CI/CD pipelines to confirm none of them target unvetted model repositories, then inspect the ~/.cache/huggingface/modules directory on developer machines and build servers for unexpected Python files. Until an official patch lands, pinning the library version in production and documenting a cache-review procedure is the most reliable mitigation available.