{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/456290#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nA vulnerability in the Hugging Face Transformers library (versions 4.57.0 to 5.16.1) allows remote, attacker‑controlled Python files to be written to the local disk without user authorization. The library performs a remote module fetch and local cache write before evaluating the `trust_remote_code` consent prompt, violating the security contract enforced across other dynamic module-loading paths in the library.\r\n\r\n### Description\r\nHugging Face Transformers serves as a primary framework for defining and operating modern machine learning models including NLP, computer vision, audio, video, and multimodal systems, for both training and inference. As detailed in ***CVE‑2026‑80047***, affected versions (4.57.0 to 5.16.1) implement GenerativePreTrainedModel.load_custom_generate() such that the library fetches and caches a remote Python module via `get_cached_module_file()` before evaluating user consent by `resolve_trust_remote_code()`. Although execution of the module is correctly gated, the initial file write is unconditional. As a result, remote code from a repository’s `custom_generate/generate.py` is copied into `~/.cache/huggingface/modules` regardless of whether the user ultimately approves or declines the trust prompt. This behavior differs from other remote code-loading mechanisms in the Transformers library (including AutoConfig, AutoModel, AutoTokenizer, and AutoImageProcessor), all of which perform `trust_remote_code` verification before fetching or writing any remote Python content. The root cause is an unconditional file copy operation in `dynamic_module_utils.py` that occurs prior to consent evaluation and cannot be rolled back. An attacker may publish a model repository containing a malicious `custom_generate/generate.py` file. Any downstream user who loads the model reference triggers the file‑write behavior without requiring elevated privileges or additional interaction beyond the initial load attempt.\r\n\r\n### Impact\r\nThe vulnerability results in persistent unauthorized Python files being written to the user’s local module cache. This content remains on the disk even if the user declines the trust prompt. In environments where cache paths are reused, previously written attacker files may be served later during trusted model loads, which could enable unintended execution of cached code.\r\n\r\n### Solution\r\nThis vulnerability has been fixed in version 5.17.0. It is recommended that all users update to the latest version of the Hugging Face Transformers library.\r\n\r\n### Acknowledgements\r\nThank you to Prasanna Dabi for reporting this vulnerability. This document was written by Bob Kemerer.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"},{"category":"other","text":"Vendor status: Affected. Fixed in transformers 5.17.0 (released 2026-09-09). Assessed severity: Low (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, 4.3).\r\n\r\nHugging Face confirms the behavior in VU#456290: load_custom_generate() fetched a repository's custom_generate/generate.py into the local dynamic module cache before the trust_remote_code consent check. Consent still governed execution, which remained gated, so a user who declined did not run the code. The defect was that the file was written before consent was evaluated. The file originates from a repository the caller named explicitly. This is resolved in 5.17.0 (PR #48620, commit cbc1651).\r\n\r\nThis is a client library issue. No Hugging Face hosted service executes this path; exposure is limited to machines running transformers.\r\n\r\nThe affected range is 4.57.0 through 5.16.1. load_custom_generate() does not exist before 4.52, and 4.52 through 4.56.2 perform the consent check before fetching. The ordering was inverted in 4.57.0. In 4.57.0 through 4.57.6 a plain from_pretrained() call on a repository containing custom_generate/generate.py was enough to trigger the write; from 5.0.0 it required an explicit custom_generate argument.\r\n\r\nWe do not agree with the CVSS 3.1 vector added by CISA-ADP and carried in NVD and GHSA-x9r9-c232-4q39 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8). A vector asserting complete confidentiality, integrity and availability impact describes code execution, which the advisory's own description states is correctly gated. Our assessment is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, 4.3 Low: the artifact is a file written to a cache directory, sourced from a repository the caller named explicitly, and it is not executed without consent.\r\n\r\nWe also do not support one impact stated in the advisory, that stale cache collisions may cause cached code to be executed during later trusted model loads. For a Hub repository, both the cache path and the resulting Python module name include the resolved 40-character commit hash of the source repository, so two repositories, or two revisions of one repository, cannot share a cached path. We would welcome a proof of concept if the reporter has one.\r\n\r\nFor users who cannot upgrade immediately: do not pass custom_generate for repositories you have not reviewed, and on 4.57.x do not call from_pretrained() on unreviewed repositories that contain custom_generate/generate.py; clear cached modules with rm -rf ~/.cache/huggingface/modules, which is rebuilt on demand and does not require clearing the weight cache at ~/.cache/huggingface/hub; set HF_HUB_OFFLINE=1 on runtimes working from pre-fetched weights.\r\n\r\nWe thank Prasanna Dabi for the report and CERT/CC for coordinating disclosure.","title":"Vendor statment from Hugging Face"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/456290"},{"url":"https://github.com/huggingface/transformers","summary":"https://github.com/huggingface/transformers"},{"url":"https://github.com/huggingface/transformers/releases/tag/v5.17.0","summary":"Reference(s) from vendor \"Hugging Face\""},{"url":"https://github.com/huggingface/transformers/pull/48620","summary":"Reference(s) from vendor \"Hugging Face\""}],"title":"Hugging Face Transformers library writes remote code to disk prior to consent check","tracking":{"current_release_date":"2026-09-24T15:30:36+00:00","generator":{"engine":{"name":"VINCE","version":"3.0.50"}},"id":"VU#456290","initial_release_date":"2026-09-01 13:35:43.148962+00:00","revision_history":[{"date":"2026-09-24T15:30:36+00:00","number":"1.20260924153036.4","summary":"Released on 2026-09-24T15:30:36+00:00"}],"status":"final","version":"1.20260924153036.4"}},"vulnerabilities":[{"title":"A vulnerability in Hugging Face Transformers (versions 4.","notes":[{"category":"summary","text":"A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). The function fetches and caches a remote module file before performing the required trust_remote_code consent check, inverting the security model enforced by other code-loading paths (such as AutoConfig, AutoModel, and AutoTokenizer). As a result, attacker‑controlled Python code from custom_generate/generate.py is copied into the user’s ~/.cache/huggingface/modules directory even if the user declines the trust prompt. Although execution is correctly gated, the file write is not reversible and can persist across sessions. This can lead to persistent, unauthorized files on disk and stale cache collisions where cached attacker code may later be executed during trusted model loads. The issue stems from an unconditional file write in dynamic_module_utils.py prior to any trust verification."}],"cve":"CVE-2026-80047","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#456290"}],"product_status":{"known_affected":["CSAFPID-f7744c60-c5e7-11f1-b91d-12ffdf7ff0b1"]}}],"product_tree":{"branches":[{"category":"vendor","name":"Hugging Face","product":{"name":"Hugging Face Products","product_id":"CSAFPID-f7744c60-c5e7-11f1-b91d-12ffdf7ff0b1"}}]}}