← Back to feed
2026-09-18 Supply ChainMalicious Tool TLP:CLEAR

CVE-2026-80047: Hugging Face Transformers Silent Remote Code Execution via Malicious Model Configuration

Date: 2026-09-18
Tags: supply-chain, malicious-tool

Executive Summary

A newly disclosed vulnerability in Hugging Face Transformers could allow malicious AI model repositories to place attacker-controlled Python files on a user's system before the user approves remote code execution. Because the framework is commonly integrated into developer workstations, research environments, cloud notebooks, and production ML pipelines, the vulnerability could expose a broad range of users to untrusted content from model repositories. Researchers said vulnerable Transformers versions were downloaded about 232 million times before a patch was released, creating supply chain risk for organizations using third-party AI models.

Campaign Summary

FieldDetail
Campaign / MalwareHugging Face Transformers Custom Generation Loading RCE
AttributionUnknown (confidence: none)
TargetAI development teams, ML researchers, and production systems loading models from Hugging Face
VectorMalicious model configuration files hosted on Hugging Face repository uploaded and executed during model.from_pretrained() calls
Statusactive
First Observed2026-09-01

Detailed Findings

The flaw lies in the library's custom generation-loading process. It can allow remote Python code to be written to the local Hugging Face module cache without authorization. The flaw originates in how Transformers processes model configuration files (config.json). Researchers found that the library relied on a generic setattr() mechanism that applied configuration parameters directly to internal objects, including private attributes that were never intended to be influenced by untrusted input. As a result, attackers could manipulate internal settings through a specially crafted model configuration. CERT/CC published the vulnerability record on September 1, 2026, with Hugging Face listed as having an unknown vendor status. The attack operates silently during routine model loading, with no user-visible warnings or prompts before code execution occurs, making it distinct from prior Hugging Face supply chain incidents that relied on explicit trust_remote_code flags.

MITRE ATT&CK Mapping

TechniqueIDContext
Supply Chain CompromiseT1195.001Attacker uploads malicious model configuration to Hugging Face; arbitrary code placed in cache without explicit approval during dependency resolution

IOCs

Domains

_CVE-2026-80047; no exploit POC or malicious models named in disclosure window; affected_platforms documented via use-case evidence from CERT/CC and researcher statements_

Full URL Paths

_CVE-2026-80047; no exploit POC or malicious models named in disclosure window; affected_platforms documented via use-case evidence from CERT/CC and researcher statements_

Splunk Format

_No IOCs available for Splunk query_

Affected Platforms

Developer workstations
Research environments
Cloud notebooks (Jupyter, Colab)
CI/CD pipelines
Production ML inference

Detection Recommendations

Monitor Hugging Face model downloads and from_pretrained() calls in development and production environments. Implement code review or static analysis of config.json files in model repositories before loading. Pin Hugging Face Transformers versions to patched releases and audit cached modules in ~/.cache/huggingface/modules/ for unexpected Python files. Implement allowlisting of trusted model repositories and require explicit approval workflows before loading third-party models. Track downloads of Transformers library versions 4.49.0 through 5.8.1 in package repositories and CI/CD logs.

References