CVE-2026-80047: Hugging Face Transformers Write-Before-Consent RCE via Malicious Model Repositories – September Republication
Date: 2026-09-10
Tags: model-poisoning, supply-chain
Executive Summary
A Hugging Face Transformers vulnerability (CVE-2026-80047) allows malicious AI model repositories to place attacker-controlled Python files on user systems before users approve remote code execution, affecting Transformers versions 4.49.0 through 5.8.1. CERT/CC published the vulnerability record on September 1, 2026, with Hugging Face listed as having unknown vendor status. This represents new official disclosure within the lookback window distinct from prior coverage.
Campaign Summary
| Field | Detail |
|---|---|
| Campaign / Malware | Hugging Face Transformers Model-Loading RCE |
| Attribution | Unknown (confidence: none) |
| Target | Machine learning developers and data scientists using Hugging Face Transformers |
| Vector | Malicious model repositories on Hugging Face Hub; automatic model loading via from_pretrained() |
| Status | active |
| First Observed | 2026-06-21 |
Detailed Findings
The flaw lies in the library's custom generation-loading process and allows remote Python code to be written to the local Hugging Face module cache without authorization. Hugging Face Transformers is widely used to train, deploy, and run machine learning models for NLP, computer vision, audio, video, and multimodal AI tasks, commonly integrated into developer workstations, research environments, cloud notebooks, and production ML pipelines. Defenders should prioritize patching to versions beyond 5.8.1 and implement model provenance validation.
MITRE ATT&CK Mapping
| Technique | ID | Context |
|---|---|---|
| Supply Chain Compromise | T1195.003 | Attacker publishes poisoned model to public repository leveraging trust in Hugging Face Hub |
IOCs
Domains
_No specific malicious package IOCs released; vulnerability is in the framework itself_
Full URL Paths
_No specific malicious package IOCs released; vulnerability is in the framework itself_
Splunk Format
_No IOCs available for Splunk query_
Affected Platforms
Hugging Face Transformers 4.49.0–5.8.1
HuggingFace Hub (huggingface.co)Detection Recommendations
Monitor ~/.cache/huggingface/modules for unexpected or modified files. Implement code signing and cryptographic verification for model artifacts before loading. Restrict use of trust_remote_code=True to explicitly vetted models. Scan model configuration files (config.json) for suspicious _attn_implementation_internal attribute values or other undocumented internal parameters.
References
- [Cyber Security News] Hugging Face Flaw Lets Malicious AI Models Plant Python Code on User Systems (2026-09-06) — https://cybersecuritynews.com/hugging-face-flaw/
- [CERT/CC] CVE-2026-80047 – Hugging Face Transformers Write-Before-Consent RCE (2026-09-01) — https://www.cert.org/vulnerability-analysis/cve-2026-80047