A vulnerability is affecting Hugging Face Transformers, a widely used AI library. Hackers can publish seemingly normal AI model repositories that plant malicious scripts on users’ systems without obtaining authorization.

Vulnerable Hugging Face versions range from 4.49.0 to the latest release, 5.8.1. The CERT Coordination Center (CERT/CC) at Carnegie Mellon University warns that no vendor-provided patch or advisory is available.

The vulnerability, tracked as CVE‑2026‑80047, “allows remote, attacker‑controlled Python files to be written to the local disk without user authorization,” according to the CERT/CC’s vulnerability note.

Hugging Face Transformers is one of the main libraries for building and running modern AI systems handling text, images, audio, video, and multimodal data.

Normally, AI models include weights and configuration files that don’t require additional permission. But some repositories also contain Python code that can be executed to run a model’s custom functions. Transformers is supposed to ask for permission before downloading and executing such code. But one function lacks those protections.

“The library performs a remote module fetch and local cache write before evaluating the trust_remote_code consent prompt, violating the security contract enforced across other dynamic module-loading paths in the library,” the CERT/CC explains.

Transformers copies the custom_generate/generate.py file from the repository and writes it “unconditionally” before asking for user consent. This operation cannot be rolled back.

The potentially malicious Python scripts are downloaded to ~/.cache/huggingface/modules, a local cache where Hugging Face stores code for processing AI models.

The library won’t execute the files without approval – execution of the module is “correctly gated.”

However, the researchers warn of “stale cache collisions” – malicious scripts can be executed later inadvertently when launching trusted models.

“In environments where cache paths are reused, previously written attacker files may be served later during trusted model loads, which could enable unintended execution of cached code,” the advisory reads.

Attackers can exploit this bug by publishing a model repository that triggers malicious file drops on every load, without elevated privileges or additional interaction. The file remains on disk even if the user declines the trust prompt.

While no official fix is available, the researchers urge to be careful when loading untrusted model repositories and recommend clearing the Hugging Face module cache periodically to remove any unexpected content.