Hugging Face Vulnerability Exposes Users to Malicious AI Model Code Execution

Key Takeaways

• A critical vulnerability (CVE-2026-80047) in Hugging Face Transformers allows remote Python code to be written to a user’s system cache without explicit consent.
• The flaw affects Transformers versions 4.49.0 through 5.8.1 and impacts users loading AI models, particularly those in development and production ML environments.
• Malicious AI models can exploit this by placing attacker-controlled files locally, even if the user declines remote code execution.
• There is currently no official patch from Hugging Face; users are advised to avoid untrusted model repositories and regularly clear their cache.

Hugging Face Vulnerability Exposes Users to Malicious AI Model Code Execution

A significant security flaw has been identified within the Hugging Face Transformers library, potentially allowing malicious AI models to implant attacker-controlled Python files onto a user’s system. This occurs even before the user explicitly grants permission for remote code execution, raising serious concerns for machine learning developers and organizations.

The vulnerability, designated as CVE-2026-80047, impacts Hugging Face Transformers versions spanning from 4.49.0 up to and including 5.8.1. At its core, the issue stems from an oversight in the library’s custom generation-loading mechanism, which permits unauthorized remote Python code to be written directly into the local Hugging Face module cache.

Hugging Face Transformers is a cornerstone in the AI community, extensively utilized for training, deploying, and executing machine learning models across diverse applications such as natural language processing, computer vision, audio, video, and multimodal AI tasks. Given its widespread integration into developer workstations, research platforms, cloud-based notebooks, and production machine learning pipelines, this vulnerability presents a broad exposure risk to users interacting with untrusted content from model repositories.

Technical Details of the Flaw

The core of the problem lies within the GenerativePreTrainedModel.load_custom_generate() function, which is responsible for loading custom text-generation logic embedded within model repositories. When a user initiates the loading of a model containing a custom_generate/generate.py file, the Transformers library fetches this file from the remote repository and caches it locally via get_cached_module_file().

Crucially, this remote retrieval and local cache write operation occurs prior to the library verifying whether the user has approved the trust_remote_code setting. The trust_remote_code prompt is designed as a critical security measure, intended to prevent arbitrary Python code from executing from a model repository unless the user explicitly acknowledges and accepts the associated risks.

While the actual execution of the remote code remains gated by this consent prompt in the vulnerable workflow, the remote Python file is nonetheless copied to the local disk before resolve_trust_remote_code() even evaluates the user’s consent. This means that a user could decline the prompt, yet still inadvertently end up with attacker-controlled Python content residing within their Hugging Face cache directory, typically located at ~/.cache/huggingface/modules.

This behavior deviates significantly from other dynamic module-loading functions within the Transformers library. For instance, components like AutoConfig, AutoModel, AutoTokenizer, and AutoImageProcessor correctly validate the trust_remote_code setting before initiating any download or local write operations for remote Python modules. The affected custom generation workflow, however, bypasses this crucial security expectation by performing the file write operation before consent verification.

Exploitation and Impact

An attacker could exploit this vulnerability by publishing a seemingly benign model repository that secretly includes a malicious custom_generate/generate.py file. Any user attempting to load this model through the compromised function could trigger the local file write, requiring no administrator privileges or further interaction beyond the initial model load attempt.

The risk escalates in environments where Hugging Face cache directories are reused across different projects or sessions. A malicious file left behind in the cache could potentially be accessed later during what appears to be a trusted model load, inadvertently creating an execution path for previously cached, attacker-controlled code.

Security researcher Prasanna Dabi brought this vulnerability to light. CERT/CC published the vulnerability record on September 1, 2026, noting Hugging Face’s vendor status as unknown regarding a patch at the time of disclosure.

What You Should Do

• Avoid Untrusted Repositories: Refrain from calling load_custom_generate() on Hugging Face model repositories from unknown or untrusted sources.
• Inspect Local Cache: Regularly inspect your local module cache (typically ~/.cache/huggingface/modules) for any unexpected or suspicious files.
• Clear Cache Regularly: For organizations utilizing shared notebooks, CI/CD pipelines, ML workstations, or persistent container volumes, consider implementing a policy to regularly clear the ~/.cache/huggingface/modules directory until an official fix is released.
• Prioritize Consent Checks: Developers should ensure that all remote-code consent checks are performed rigorously and precede any remote download or local file write operations in their own implementations.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.