← Back to feed
2026-09-02 Supply ChainModel Poisoning TLP:CLEAR

CVE-2026-80047: Hugging Face Transformers Write-Before-Consent Vulnerability Enables Malicious Model RCE

Date: 2026-09-02
Tags: supply-chain, model-poisoning

Executive Summary

A newly disclosed vulnerability in Hugging Face Transformers (CVE-2026-80047) affecting versions 4.49.0 through 5.8.1 allows malicious AI model repositories to place attacker-controlled Python files on a user's system before the user approves remote code execution; the flaw lies in the library's custom generation-loading process and can allow remote Python code to be written to the local Hugging Face module cache without authorization. CERT/CC published the vulnerability record on September 1, 2026.

Campaign Summary

FieldDetail
Campaign / MalwareHugging Face Transformers Malicious Model Supply Chain Attack Vector
AttributionUnknown (vulnerability disclosure only; no active campaign reported yet) (confidence: low)
TargetDevelopers and ML engineers using Hugging Face Transformers to load custom models from Hugging Face Hub
VectorMalicious model repository containing crafted custom_generate/generate.py file that exploits load_custom_generate() function
Statusactive
First Observed2026-09-01

Detailed Findings

Affected versions (4.49.0 through 5.8.1) implement GenerativePreTrainedModel.load_custom_generate() such that the library fetches and caches a remote Python module via get_cached_module_file() before evaluating user consent via resolve_trust_remote_code(); although execution of the module is correctly gated, the initial file write is unconditional, resulting in remote code from a repository's custom_generate/generate.py being copied into ~/.cache/huggingface/modules regardless of whether the user ultimately approves or declines the trust prompt. The file write is not reversible and can persist across sessions, leading to persistent, unauthorized files on disk and stale cache collisions where cached attacker code may later be executed during trusted model loads. Hugging Face Transformers is widely used to train, deploy, and run machine learning models for natural language processing, computer vision, audio, video, and multimodal AI tasks, and because the framework is commonly integrated into developer workstations, research environments, cloud notebooks, and production ML pipelines, the vulnerability could expose a broad range of users to untrusted content from model repositories.

MITRE ATT&CK Mapping

TechniqueIDContext
Supply Chain CompromiseT1195.001Attacker compromises third-party model repository on Hugging Face Hub to distribute trojanized models containing malicious custom_generate.py
Execution through APIT1059.006Malicious Python code is automatically downloaded and cached without explicit user consent, enabling code execution through the Transformers library API

IOCs

Domains

huggingface.co

Full URL Paths

_Vulnerability disclosed by security researcher Prasanna Dabi; no active exploit code published at time of disclosure per CERT/CC record_

Splunk Format

"huggingface.co"

Package Indicators

pypi:[email protected]
pypi:[email protected]
pypi:[email protected]
pypi:[email protected]
pypi:[email protected]
pypi:[email protected]
pypi:[email protected]
pypi:[email protected]
pypi:[email protected]
pypi:[email protected]
pypi:[email protected]
pypi:[email protected]
pypi:[email protected]
pypi:[email protected]

Affected Platforms

Python development environments
ML/AI workstations
CI/CD pipelines
Cloud notebooks

Detection Recommendations

Organizations using Hugging Face Transformers should immediately upgrade to patched versions (5.8.2 or later). Defenders should audit ~/.cache/huggingface/modules directories on developer workstations for unexpected Python files and monitor for creation of new files in cache directories during model loading operations. Implement file integrity monitoring on cache directories and alert on modifications to custom_generate/generate.py paths. Restrict model downloads to trusted, internally-cached models where feasible. Enable audit logging for all Hugging Face model loading calls and correlate suspicious file creation with model load operations. Red teamers should test whether stale cached files from declined trust prompts can be executed during subsequent trusted model loads (cache collision attack).

References