A flaw in the Hugging Face Transformers library allows an attacker to write arbitrary Python files to the user’s local cache before a trust consent check is performed. The load_custom_generate() function downloads and stores a remote module file in the ~/.cache/huggingface/modules directory, bypassing the trust_remote_code prompt even when the user declines consent. While the library still prevents execution of the downloaded code in that session, the unconditional write leaves malicious files on disk permanently and can lead to stale cache collisions when the same module is later loaded under a trusted flag. This persistence creates a potential vector for later execution and for covering tracks by defacing the cache.

The issue affects all releases of the Hugging Face Transformers library from version 4.49.0 through 5.8.1 inclusive. Users who employ GenerativePreTrainedModel.load_custom_generate() for custom generation or packaging of models are exposed, while other typical loading paths such as AutoConfig, AutoModel, or AutoTokenizer remain unaffected.

Based on the description, it is inferred that the attack can be carried out remotely by hosting a malicious script and invoking load_custom_generate() or locally by manipulating mirror sources. The unconditional file write before user consent creates a persistence vector. The CVSS score is 7.8, the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The lack of publicly known exploitation coupled with the need for a valid model path suggests that the likelihood of widespread exploitation is moderate, but the potential impact includes persistent unauthorized files and the risk of future execution.