Hugging Face Transformers Bug Can Drop Malicious Scripts on User Systems

A Hugging Face Transformers bug can write attacker-controlled Python files to a user’s computer before the library asks for permission to trust remote code. The vulnerability affects a widely used AI development library and may leave malicious scripts in the local cache after a user rejects the prompt.

Tracked as CVE-2026-80047, the issue affects Transformers versions 4.49.0 through 5.8.1. CERT/CC says no vendor patch or advisory was available at the time of publication.

Flaw writes files before user consent

Hugging Face Transformers supports AI models that handle text, images, audio, video and other data. Most model repositories contain weights and configuration files, but some also include Python code for custom functions.

The library normally asks users to approve remote code before it downloads and runs that code. However, the Hugging Face Transformers bug affects one path that does not follow those protections.

When loading a malicious repository, the library can fetch the custom_generate/generate.py file and write it to the local disk before displaying the trust_remote_code consent prompt.

The write happens automatically and cannot be reversed. The file remains on the system even if the user refuses permission.

Cached scripts may run later by mistake

Transformers stores downloaded modules in the ~/.cache/huggingface/modules directory. The library does not execute a malicious script immediately without approval, which limits the direct impact.

However, CERT/CC warns that cached files may create a separate risk later. If cache paths are reused, a trusted model load could unintentionally use a Python file that an attacker placed there earlier.

This type of stale cache collision could lead to malicious code execution even though the user initially declined the remote-code request.

Attackers can exploit the issue by publishing a seemingly legitimate model repository. Each time someone loads the repository, the vulnerable function can write the attacker-controlled file to the local cache.

No patch available for CVE-2026-80047

The vulnerability affects versions from 4.49.0 through the latest reported release, 5.8.1. CERT/CC says users should treat untrusted model repositories with extra caution until a fix becomes available.

Developers should avoid loading models from unknown or unverified sources. They should also review their local Hugging Face module cache for unexpected files and clear it periodically where practical.

Teams that share development systems, caches or deployment environments should take particular care. Reused cache paths can increase the chance that a malicious file written during one model load affects another workflow later.

The Hugging Face Transformers bug shows why consent prompts must happen before a library downloads or stores untrusted code. A prompt cannot fully protect users if the file already exists on their system.