Hugging Face Transformers Downloads Custom Code Before Consent
Transformers
A vulnerability in Hugging Face Transformers allows remote Python files to be written to disk without consent. This inverts the standard security model enforced by other loading paths.
disclosed CVENo confirmed exploitation, so this record is tracked as a disclosed vulnerability and not counted as an incident. It moves into the counts if CISA or the vendor confirms exploitation. Why
- CVSS
- 7.8
- EPSS
- <0.01 · top 100% · 2026-11-13
- fix status
- Fix status unknown
- first report
- 1 Sep 2026
- last update
- 1 Sep 2026
- CVE ids
Timeline · 2
Sources · 2
Advisories and databases
- 2026-09-01CVE-2026-80047: Hugging Face Transformers downloads custom generation code before trust consentGitHub Advisory Database · github.com/advisories/GHSA-x9r9-c232-4q39
- 2026-09-01CVE-2026-80047: A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote Python files to be written to local disk…NVD · nvd.nist.gov/vuln/detail/CVE-2026-80047
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- lane
- Supply chain
- AI role
- Attack on AI
- categories
- Supply chainInfrastructure vulnerability
- severity
- 2 · Disclosed vulnerability
- fix status
- Fix status unknown
- targets
- Framework / tooling
- owasp llm top 10
- LLM03:2025 Supply Chain
- mitre atlas
- AML.T0010 AI Supply Chain Compromise
- dates
- happened 1 Sep 2026 · first reported 1 Sep 2026
- origin
- GitHub Advisory DatabaseVulnerability record from NVD / the GitHub Advisory Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- record
- confidence 0.95 · created 2026-10-18 06:33Z · updated 2026-10-18 06:33Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# Hugging Face Transformers Downloads Custom Code Before Consent https://gcdradar.vercel.app/incidents/hugging-face-transformers-downloads-custom-code-before-conse · AIR-2026-0099 · closed 2026-09-01 - Lane: Supply chain - Severity: 2 (Disclosed vulnerability) - Fix status: Fix status unknown - First reported: 2026-09-01 - AI role: Attack on AI - Products: Transformers - CVE ids: CVE-2026-80047 - CVSS: 7.8 ## Summary A vulnerability in Hugging Face Transformers allows remote Python files to be written to disk without consent. This inverts the standard security model enforced by other loading paths. ## What to do No action recorded; read the sources below and the vendor's advisory. ## Latest updates - 2026-09-01: CVE-2026-80047: A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote Python files to be written to local disk… (https://nvd.nist.gov/vuln/detail/CVE-2026-80047) - 2026-09-01: CVE-2026-80047: Hugging Face Transformers downloads custom generation code before trust consent (https://github.com/advisories/GHSA-x9r9-c232-4q39) ## Sources - 2026-09-01 GitHub Advisory Database: CVE-2026-80047: Hugging Face Transformers downloads custom generation code before trust consent https://github.com/advisories/GHSA-x9r9-c232-4q39 - 2026-09-01 NVD: CVE-2026-80047: A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote Python files to be written to local disk… https://nvd.nist.gov/vuln/detail/CVE-2026-80047 Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- closed7.1Hugging Face libraries Hugging Face Transformers save_pretrained allows arbitrary file writes
Patch now · Disclosed · since 2 Aug 2026 · CVE-2026-9856
AI - closed6.5Hugging Face libraries CVE-2026-1839: HuggingFace Transformers Arbitrary Code Execution in Trainer
Patch now · Disclosed · since 7 Apr 2026 · CVE-2026-1839
AI - closed7.8Hugging Face libraries Hugging Face Transformers Megatron GPT2 Deserialization RCE
Patch now · Disclosed · since 23 Dec 2025 · CVE-2025-14924
AI - closed4.1LangChain4j CVE-2026-97869: LangChain4j deserialization flaw in AgenticScopeSerializer
Patch now · Disclosed · since 25 Sep 2026 · CVE-2026-97869
AI - closed8.8NVIDIA NeMo CVE-2026-65179: Insecure pickle deserialization in NVIDIA NeMo
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-65179
AI - closed8.5vLLM CVE-2026-90553: vLLM Remote Code Execution Vulnerability
Patch now · Disclosed · since 12 Sep 2026 · CVE-2026-90553
AI