Hugging Face Transformers Downloads Custom Generation Code Before Trust Consent
OSV · 1 source
What's on the official record
The OSV advisory GHSA-x9r9-c232-4q39, dated 1 September 2026, reports a vulnerability in the PyPI package transformers with severity HIGH and affected versions 4.49.0, <= 5.8.1. The advisory names no fixed version. The vulnerability allows remote Python files to be written to local disk without user consent when code uses GenerativePreTrainedModel.load_custom_generate(). The advisory lists the alias CVE-2026-80047 and CWE-273; the alias carried an EPSS score of 0.001 (percentile 1) as of 23 October 2026.
Assessment
For a platform or AI-stack owner, the advisory records a HIGH-severity finding in transformers with no fixed version named. The check is whether any deployed or pinned version falls inside 4.49.0, <= 5.8.1, and whether any code path calls GenerativePreTrainedModel.load_custom_generate(), the function tied to remote Python files being written to local disk without user consent. Until a patched version is published, the record supports pinning and isolating affected versions.
For a deal team, the advisory gives diligence a concrete package and version window — transformers 4.49.0, <= 5.8.1 — and a specific call path, GenerativePreTrainedModel.load_custom_generate(), where remote Python files can be written to local disk without user consent. With no fixed version named in the advisory, a buyer or investor can ask the target to show its remediation plan and version control before pricing or closing.
What would change this call
A patched release from the transformers maintainers would move the call from pin-and-isolate to upgrade. Evidence of active exploitation or a listing in CISA's Known Exploited Vulnerabilities Catalog would raise urgency. A maintainer statement clarifying the affected range would sharpen the scope.
What to check next
| Check | What it tells you |
|---|---|
| Inventory transformers versions in deployed and CI environments | Confirms whether 4.49.0, <= 5.8.1 is present |
| Locate calls to GenerativePreTrainedModel.load_custom_generate() | Identifies the code path that can write remote files to disk without user consent |
| Watch the advisory page for a patched release | Confirms the fixed version once the maintainers publish one |
| Review dependents and pinned wheels | Captures transitive exposure to the affected versions |
Confidence
This is a single-source note compiled from the OSV advisory as published. The severity (HIGH), the affected version window, and the absence of a fixed version are taken directly from that record. No independent corroboration beyond the advisory was available at filing. Filed 23 October 2026 from the record dated 1 September 2026.
Sources
[1] Hugging Face Transformers downloads custom generation code before trust consent — https://github.com/advisories/GHSA-x9r9-c232-4q39