A vulnerability in the Hugging Face Transformers library allows an attacker to write arbitrary Python files to a local cache before the user consents to load remote code. The malicious file is fetched via GenerativePreTrainedModel.load_custom_generate(), cached in the ~/.cache/huggingface/modules directory, and can persist across future sessions. Because execution of the cached module is still gated by trust_remote_code checks, the file is not immediately executed, but its presence can enable stale cache collisions that lead to later execution when a trusted model load occurs. This results in persistent, unauthorized code on disk and the potential for malicious code to run in future sessions.

Vulnerable versions of the Hugging Face Transformers library include 4.49.0 and all releases up to and including 5.8.1. The vulnerability affects users who employ GenerativePreTrainedModel.load_custom_generate() to inject remote code into the model pipeline. It does not impact other typical Hugging Face loading paths such as AutoConfig, AutoModel, or AutoTokenizer.

The vulnerability carries a high risk to confidentiality and integrity of local environments where the Transformers library is used. Although no CVSS score is publicly published, the flaw permits an attacker to leave malicious files in a well‑known cache location, potentially enabling later execution when trusted code loads. EPSS is not available and the flaw is not listed in CISA’s KEV catalog, indicating a lower publicly known exploitation probability, but the attack model requires the attacker to supply or force the loading of a remote module through load_custom_generate(). The attack can be performed remotely by hosting a malicious script and using the API call to pull it, or locally by manipulating local mirror sources. The lack of reversible writes means once the file is cached it remains until the cache is cleared, creating a persistence vector.