Hugging Face Transformers: load_custom_generate writes remote code to disk before the trust check

Impact

GenerativePreTrainedModel.load_custom_generate() fetches and caches the remote custom_generate/generate.py file before it evaluates trust_remote_code, inverting the order every other loading path (AutoConfig, AutoModel, AutoTokenizer) uses. Execution is still gated, so declining the prompt does not run the code - but the file is already written into ~/.cache/huggingface/modules and stays there. The consequences an operator has to care about are persistence and cache collision: attacker-supplied Python sits in the module cache across sessions, and a later trusted model load that resolves to the same cached module name can pick it up. On a fleet where the Hugging Face cache is a shared volume mounted into many training or serving pods, one pod evaluating an untrusted repo can leave that file where other jobs will find it. Affects 4.49.0 through 5.8.1.

Who can reach it

Anyone who can get a job on the fleet to call load_custom_generate() against a model repository they control - a tenant pointing a training script at an untrusted Hub repo, or a typosquatted repo id in a pipeline. No credentials on the cluster are needed by the attacker; the write happens even if the operator declines the trust prompt.

What to do

The record names versions >= 4.49.0 and <= 5.8.1 as affected and does not state a fixed release - consult CERT/CC VU#456290 and the Transformers repository for the fixed version before pinning one, and do not assume the next release number. Meanwhile: avoid load_custom_generate() against repositories you do not control, stop sharing a single writable ~/.cache/huggingface/modules across tenants or jobs, and purge that directory on hosts and in shared cache volumes since already-written files persist. Applying a new Transformers version means rebuilding serving and training images and restarting the workloads; no node reboot.

References

Related entries

• Jupyter Notebook (untrusted notebooks): Untrusted notebook executes JavaScript in the user's session on openCVE-2021-32798 · Jupyter Notebook (untrusted notebooks)Critical
• MLflow: Absolute path traversal prior to 2.5.0CVE-2023-3765 · MLflowCritical
• TorchServe: Unauthenticated SSRFCVE-2023-43654 · TorchServeCritical
• BentoML: Insecure deserializationCVE-2024-2912 · BentoMLCritical
• llama.cpp (RPC backend): Unsafe `data` pointer in `rpc_tensor`CVE-2024-42479 · llama.cpp (RPC backend)Critical
• MLflow (`extract_archive_to_dir`): Path traversal in the dbconnect artifact cacheCVE-2025-15036 · MLflow (`extract_archive_to_dir`)Critical