Remote Python File Write in Hugging Face Transformers

Executive Summary

This vulnerability in Hugging Face Transformers (versions 4.49.0 to 5.8.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). The function fetches and caches a remote module file before performing the required trust_remote_code consent check, which inverts the security model used by other code-loading paths.

Useful 0 Not Useful 0

Detection Guidance

Check the Hugging Face module cache directory for unexpected Python files. Inspect ~/.cache/huggingface/modules for files named custom_generate/generate.py or similar. Use commands like ls -la ~/.cache/huggingface/modules/custom_generate/ to list cached files.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this by publishing a model repository containing a malicious custom_generate/generate.py file. This file would be written to the cache upon loading the model, even if the user declines the consent prompt. The persistent unauthorized file writes may later be executed if cache paths are reused, potentially enabling unintended code execution.

Useful 0 Not Useful 0

Mitigation Strategies

Avoid loading untrusted model repositories with load_custom_generate(). Periodically inspect and clear the Hugging Face module cache using rm -rf ~/.cache/huggingface/modules/. Ensure trust_remote_code checks are enforced before any remote content retrieval or file writes.

Useful 0 Not Useful 0