← Back to feed
2026-09-05 Model PoisoningSupply Chain TLP:CLEAR

CVE-2026-80047: Hugging Face Transformers Write-Before-Consent RCE via Malicious Model Repositories

Date: 2026-09-05
Tags: model-poisoning, supply-chain

Executive Summary

A newly disclosed vulnerability in Hugging Face Transformers (versions 4.49.0 through 5.8.1) allows malicious AI model repositories to place attacker-controlled Python files on a user's system before the user approves remote code execution, allowing remote Python code to be written to the local Hugging Face module cache without authorization. CERT/CC published the vulnerability record on September 1, 2026. The framework is commonly integrated into developer workstations, research environments, cloud notebooks, and production ML pipelines, exposing a broad range of users to untrusted content from model repositories.

Campaign Summary

FieldDetail
Campaign / MalwareUnknown—Vulnerability Disclosure Only
AttributionUnknown (confidence: none)
TargetAI/ML developers using Hugging Face Transformers for custom generation logic
VectorMalicious model repositories on Hugging Face with crafted custom_generate/generate.py payloads
Statusactive
First Observed2026-09-01

Detailed Findings

The vulnerability allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(), with the function fetching and caching a remote module file before performing the required trust_remote_code consent check, inverting the security model enforced by other code-loading paths. Attacker-controlled Python code from custom_generate/generate.py is copied into the user's ~/.cache/huggingface/modules directory even if the user declines the trust prompt; although execution is correctly gated, the file write is not reversible and can persist across sessions, leading to persistent, unauthorized files on disk and stale cache collisions where cached attacker code may later be executed during trusted model loads. Security researcher Prasanna Dabi reported the vulnerability.

MITRE ATT&CK Mapping

TechniqueIDContext
Supply Chain CompromiseT1195.001Compromised model repositories trigger RCE via trusted ML library loading mechanism

IOCs

Domains

_No IOCs published; vulnerability is in library code path, not specific attacker payloads_

Full URL Paths

_No IOCs published; vulnerability is in library code path, not specific attacker payloads_

Splunk Format

_No IOCs available for Splunk query_

Package Indicators

pypi:[email protected]

Affected Platforms

PyPI
Hugging Face model hub

Detection Recommendations

Monitor ~/.cache/huggingface/modules for suspicious Python files appearing without user consent prompts. Audit load_custom_generate() calls and validate model sources before loading. Implement integrity checks on custom generation code and restrict trust_remote_code usage to verified sources. Upgrade to patched Transformers versions immediately upon availability.

References