CVE-2026-80047: CWE-273 Improper Check for Dropped Privileges in Hugging Face Transformers

The vulnerability in Hugging Face Transformers (>=4.57.0 <=5.16.1) involves improper privilege checking (CWE-273) in the load_custom_generate() function of GenerativePreTrainedModel. The function fetches and caches remote Python code before performing the required trust_remote_code consent check, inverting the intended security model used by other code-loading paths. As a result, attacker-controlled Python code is written unconditionally to the user's ~/.cache/huggingface/modules directory even if the user declines the trust prompt. While execution of this code is prevented without user consent, the presence of these files can lead to persistent unauthorized files and stale cache collisions that may later execute during trusted model loads. The root cause is an unconditional file write in dynamic_module_utils.py prior to trust verification.

An attacker can cause remote Python files to be written to the victim's local disk without consent, leading to persistent unauthorized files in the cache directory. Although immediate execution of attacker code is blocked by the trust prompt, the stale cached files may be executed later during trusted model loads, potentially leading to code execution, data compromise, or denial of service. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using the load_custom_generate() function with untrusted remote code. Monitor vendor advisories for updates and apply official patches once released.