GHSA-x9r9-c232-4q39 CVE-2026-80047 PYSEC-2026-4174
Hugging Face Transformers downloads custom generation code before trust consent
- Severity
- 7.8 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.10%
- Chance of exploitation in the next 30 days. Higher than 0.79% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-273 Improper Check for Dropped Privileges
- Fix
- None yet
- No fixed version published
Description
A vulnerability in Hugging Face Transformers (versions 4.49.0, <= 5.8.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). The function fetches and caches a remote module file before performing the required trust_remote_code consent check, inverting the security model enforced by other code-loading paths (such as AutoConfig, AutoModel, and AutoTokenizer). As a result, attacker‑controlled Python code from custom_generate/generate.py is copied into the user’s ~/.cache/huggingface/modules directory even if the user declines the trust prompt. Although execution is correctly gated, the file write is not reversible and can persist across sessions. This can lead to persistent, unauthorized files on disk and stale cache collisions where cached attacker code may later be executed during trusted model loads. The issue stems from an unconditional file write in dynamic_module_utils.py prior to any trust verification.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| transformers | >= 4.49.0, <= 5.8.1 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-273: Improper Check for Dropped Privileges
The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.
How to prevent it
- Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
- Implementation: Check the results of all functions that return a value and verify that the value is expected.
- Implementation: In Windows, make sure that the process token has the SeImpersonatePrivilege(Microsoft Server 2003). Code that relies on impersonation for security must ensure that the impersonation succeeded, i.e., that a proper privilege demotion happened.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-xrqw-3rrv-vx5w Transformers save_pretrained path traversal allows arbitrary file writes through chat template names | High | Also affects transformers |
| GHSA-fgcw-684q-jj6r huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path | Critical | Also affects transformers |
| GHSA-29pf-2h5f-8g72 HuggingFace transformers vulnerable to remote code execution | High | Also affects transformers |
| GHSA-69w3-r845-3855 HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class | High | Also affects transformers |
| PYSEC-2025-218 Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability. | High | Also affects transformers |
| PYSEC-2025-217 Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. | High | Also affects transformers |
| PYSEC-2025-216 Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability. | High | Also affects transformers |
| PYSEC-2025-215 Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability. | High | Also affects transformers |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor