GCVE-110-CERTCC-2026-456290

### Overview A vulnerability in the Hugging Face Transformers library (versions 4.49.0 through 5.8.1) allows remote, attacker‑controlled Python files to be written to the local disk without user authorization. The library performs a remote module fetch and local cache write before evaluating the `trust_remote_code` consent prompt, violating the security contract enforced across other dynamic module-loading paths in the library. ### Description Hugging Face Transformers serves as a primary framework for defining and operating modern machine learning models including NLP, computer vision, audio, video, and multimodal systems, for both training and inference. As detailed in ***CVE‑2026‑80047***, affected versions (4.49.0 through 5.8.1) implement GenerativePreTrainedModel.load_custom_generate() such that the library fetches and caches a remote Python module via `get_cached_module_file()` before evaluating user consent by `resolve_trust_remote_code()`. Although execution of the module is correctly gated, the initial file write is unconditional. As a result, remote code from a repository’s `custom_generate/generate.py` is copied into `~/.cache/huggingface/modules` regardless of whether the user ultimately approves or declines the trust prompt. This behavior differs from other remote code-loading mechanisms in the Transformers library (including AutoConfig, AutoModel, AutoTokenizer, and AutoImageProcessor), all of which perform `trust_remote_code` verification before fetching or writing any remote Python content. The root cause is an unconditional file copy operation in `dynamic_module_utils.py` that occurs prior to consent evaluation and cannot be rolled back. An attacker may publish a model repository containing a malicious `custom_generate/generate.py` file. Any downstream user who loads the model reference triggers the file‑write behavior without requiring elevated privileges or additional interaction beyond the initial load attempt. ### Impact The vulnerability results in persistent unauthorized Python files being written to the user’s local module cache. This content remains on the disk even if the user declines the trust prompt. In environments where cache paths are reused, previously written attacker files may be served later during trusted model loads, which could enable unintended execution of cached code. ### Solution At the time of writing, no vendor-provided patch or advisory is available. Users should avoid invoking `load_custom_generate()` with untrusted model repositories and periodically inspect or clear the Hugging Face module cache (`~/.cache/huggingface/modules`) to remove unexpected content. Implementations should ensure that `trust_remote_code` checks occur prior to any remote content retrieval or local file writes. ### Acknowledgements Thank you to Prasanna Dabi for reporting this vulnerability. This document was written by Bob Kemerer.