A flaw in Hugging Face Transformers between versions 4.57.0 and 5.16.1 lets an attacker upload arbitrary Python files to a user‑owned local cache before any trust consent check occurs. When GenerativePreTrainedModel.load_custom_generate() is called, it fetches and stores a remote module file in ~/.cache/huggingface/modules, ignoring the trust_remote_code prompt even if the user declines consent. The library blocks execution in the current session, but the unconditional write leaves malicious code on disk, persisting across sessions and potentially being executed later when the same module is loaded under a trusted flag. This creates a persistent vector for future exploitation and for tampering with the cache.

The issue affects all releases of the Hugging Face Transformers library from version 4.57.0 through 5.16.1 inclusive. Users who employ GenerativePreTrainedModel.load_custom_generate() for custom generation or packaging of models are exposed, while other typical loading paths such as AutoConfig, AutoModel, or AutoTokenizer remain unaffected.

Based on the description, it is inferred that the attack can be carried out remotely by hosting a malicious script and invoking load_custom_generate() or locally by manipulating mirror sources. The unconditional file write before user consent creates a persistence vector. The CVSS score is 7.8, the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The lack of publicly known exploitation coupled with the need for a valid model path suggests that the likelihood of widespread exploitation is moderate, but the potential impact includes persistent unauthorized files and the risk of future execution.