Hugging Face Transformers bug can drop malicious scripts on user systems
It writes files to disk without permission.
Hugging Face. Image by Cybernews, Unsplash / Richard Horvath / Paris Bilal
Follow us
- A Hugging Face Transformers flaw can write attacker-controlled Python files to a user’s local disk.
- CERT/CC says affected versions run from 4.49.0 through 5.8.1, with no vendor patch available.
- The library does not run the files without approval, but cached files may execute later by mistake.
- Researchers advise caution with untrusted model repositories and recommend clearing the Hugging Face module cache periodically.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
A vulnerability is affecting Hugging Face Transformers, a widely used AI library. Hackers can publish seemingly normal AI model repositories that plant malicious scripts on users’ systems without obtaining authorization.
Vulnerable Hugging Face versions range from 4.49.0 to the latest release, 5.8.1. The CERT Coordination Center (CERT/CC) at Carnegie Mellon University warns that no vendor-provided patch or advisory is available.
The vulnerability, tracked as CVE‑2026‑80047, “allows remote, attacker‑controlled Python files to be written to the local disk without user authorization,” according to the CERT/CC’s vulnerability note.
Hugging Face Transformers is one of the main libraries for building and running modern AI systems handling text, images, audio, video, and multimodal data.
Normally, AI models include weights and configuration files that don’t require additional permission. But some repositories also contain Python code that can be executed to run a model’s custom functions. Transformers is supposed to ask for permission before downloading and executing such code. But one function lacks those protections.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
“The library performs a remote module fetch and local cache write before evaluating the trust_remote_code consent prompt, violating the security contract enforced across other dynamic module-loading paths in the library,” the CERT/CC explains.
Transformers copies the custom_generate/generate.py file from the repository and writes it “unconditionally” before asking for user consent. This operation cannot be rolled back.
The potentially malicious Python scripts are downloaded to ~/.cache/huggingface/modules, a local cache where Hugging Face stores code for processing AI models.
The library won’t execute the files without approval – execution of the module is “correctly gated.”
Check if your data was exposed
Find out if your email and related personal information have appeared in known data breaches.
However, the researchers warn of “stale cache collisions” – malicious scripts can be executed later inadvertently when launching trusted models.
“In environments where cache paths are reused, previously written attacker files may be served later during trusted model loads, which could enable unintended execution of cached code,” the advisory reads.
Attackers can exploit this bug by publishing a model repository that triggers malicious file drops on every load, without elevated privileges or additional interaction. The file remains on disk even if the user declines the trust prompt.
While no official fix is available, the researchers urge to be careful when loading untrusted model repositories and recommend clearing the Hugging Face module cache periodically to remove any unexpected content.