This briefing was produced by AI from the linked sources and is scheduled for human editorial review within 24 hours. Read the sources directly for material decisions.
EVIDENCE — CERT/CC disclosed CVE-2026-80047 on 1 September 2026, affecting Hugging Face Transformers versions 4.49.0 through 5.8.1. When GenerativePreTrainedModel.load_custom_generate() points at a remote model repository, the affected path retrieves custom_generate/generate.py and writes it into the Transformers dynamic-module cache before resolving the trust_remote_code decision. CERT/CC says execution remains gated; the vulnerability is the unauthorized, persistent write that occurs even when the user ultimately declines consent.
THE ORDER OF OPERATIONS IS THE BUG — The version 5.8.1 source makes the sequence visible: load_custom_generate() first calls get_cached_module_file(), then calls resolve_trust_remote_code(). The caching helper downloads the remote module, creates a commit-specific directory, and copies the Python file into the local module cache. Hugging Face’s documentation describes trust_remote_code=True as the explicit step for loading custom model code and advises pinning a commit after reviewing it. Here, the file crosses the local boundary before that documented trust decision.
WHY A NON-EXECUTED FILE STILL MATTERS — CERT/CC says the attacker-controlled file remains under ~/.cache/huggingface/modules after a rejected prompt. In environments that reuse caches—developer workstations, notebook images, CI runners, inference hosts, or shared model services—a later trusted load may encounter content placed there by an earlier untrusted request. That is a potential path to unintended execution, not evidence that declining the prompt immediately executes code, that Transformers has been exploited in the wild, or that every cached Python file is malicious.
THE VENDOR GAP IS PART OF THE SIGNAL — At publication, CERT/CC reported no vendor advisory or vendor-provided patch and listed Hugging Face’s status as unknown. The project’s public GitHub security-advisory page likewise showed no published advisories when checked on 2 September. Defenders should therefore track the upstream repository and CERT note for an authoritative fixed version instead of guessing that a later package number is safe.
WHAT TO CHECK — Inventory Transformers versions 4.49.0 through 5.8.1 and locate direct or wrapped calls to load_custom_generate(). Until an upstream fix is identified, avoid using that method with untrusted model repositories. Inspect and, where operationally safe, clear ~/.cache/huggingface/modules of unexpected content; isolate caches by workload and trust level; prevent untrusted jobs from writing into caches later consumed by privileged or production jobs; and pin reviewed model code to an immutable commit. Preserve suspicious files, paths, timestamps, hashes, model references, and job logs before deletion. Editorial view: a consent dialog cannot protect a boundary the program has already crossed.