CVE-2026-80047

Hugging Face Transformers (versions 4.49.0 through ≤ 5.8.1 ) contains a flaw in GenerativePreTrainedModel.load_custom_generate() where a remote Python module is fetched and written to the local ~/.cache/huggingface/modules directory before the trust_remote_code consent check is performed. This in...