CVE-2026-80047
Description
A flaw was found in the Hugging Face Transformers library. A remote attacker could exploit this vulnerability by enticing a user to load a model using the GenerativePreTrainedModel.load_custom_generate() function. This function writes remote Python files to the local disk without requiring explicit user consent, bypassing intended security checks. This can result in unauthorized files persisting on the system and potentially lead to the execution of previously cached malicious code during subsequent trusted model loads.
Statement
Red Hat Product Security has determined that this issue affects Red Hat OpenShift AI, Red Hat Enterprise Linux AI, Ansible Automation Platform Lightspeed, and OpenShift Lightspeed products that bundle the Hugging Face Transformers library (versions 4.49.0 through 5.8.1). The vulnerability allows remote Python files to be written to the user's local cache without consent when using the GenerativePreTrainedModel.load_custom_generate() function. While code execution is correctly gated behind trust verification, the unauthorized file write can result in persistent malicious files that may later be executed during subsequent trusted model loads via cache collisions. The impact is limited to scenarios where users load models from attacker-controlled repositories.
Mitigation
Until a fix is available, users should only load models from trusted repositories. Avoid using the GenerativePreTrainedModel.load_custom_generate() function with models from untrusted or unknown sources. Organizations should implement controls to restrict which model repositories their AI/ML workloads can access.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 7.8 |
| Attack Vector | Network | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
