← Back to feed
2026-09-07 Supply ChainMalicious Tool TLP:CLEAR

CVE-2026-80047: Hugging Face Transformers Write-Before-Consent RCE via Malicious Model Repositories

Date: 2026-09-07
Tags: supply-chain, malicious-tool

Executive Summary

A vulnerability in Hugging Face Transformers (CVE-2026-80047) allows malicious AI model repositories to place attacker-controlled Python files on a user's system before the user approves remote code execution, affecting versions 4.49.0 through 5.8.1. While the library blocks execution when a user declines the prompt, the remote Python file has already been copied to disk in the default local cache location, ~/.cache/huggingface/modules, where it can remain after the model-loading attempt concludes. CERT/CC published the vulnerability record on September 1, 2026.

Campaign Summary

FieldDetail
Campaign / MalwareHugging Face Transformers Model Poisoning
AttributionUnknown (confidence: none)
TargetAI developers and ML teams using Hugging Face model repositories and Transformers library
VectorMalicious model configuration files (config.json) exploiting unsafe custom generation-loading process
Statusactive
First Observed2026-09-01

Detailed Findings

The flaw lies in the library's custom generation-loading process, allowing remote Python code to be written to the local Hugging Face module cache without authorization. Because the framework is commonly integrated into developer workstations, research environments, cloud notebooks, and production ML pipelines, the vulnerability could expose a broad range of users to untrusted content from model repositories. Organizations using shared notebooks, CI/CD pipelines, ML workstations, or persistent container volumes should consider clearing ~/.cache/huggingface/modules regularly until a fix is released.

MITRE ATT&CK Mapping

TechniqueIDContext
Supply Chain CompromiseT1195.001Compromise of AI model supply chain through malicious repository uploads that execute code during model loading

IOCs

Domains

_No specific IOCs published; vulnerability is in model loading mechanism affecting any malicious model uploaded to Hugging Face_

Full URL Paths

_No specific IOCs published; vulnerability is in model loading mechanism affecting any malicious model uploaded to Hugging Face_

Splunk Format

_No IOCs available for Splunk query_

Affected Platforms

Hugging Face Transformers (versions 4.49.0-5.8.1)

Detection Recommendations

  1. Patch Hugging Face Transformers to latest version immediately. 2. Clear ~/.cache/huggingface/modules on all systems until patch deployed. 3. Monitor for unexpected Python files in .cache/huggingface/modules directory. 4. Implement model origin verification and code review for non-official Hugging Face models before loading in production. 5. Use sandboxed environments for untrusted model evaluation. 6. Enable audit logging for from_pretrained() calls in ML pipelines. 7. Implement least-privilege access controls in CI/CD and development environments.

References