Hugging Face Transformers EUVD-2026-69144

The user must explicitly call GenerativePreTrainedModel.load_custom_generate() on a model repository controlled by the attacker - this function is not invoked automatically by standard model loading via AutoModel or AutoTokenizer, so users of standard loading paths are unaffected. The attacker must control or compromise a Hugging Face Hub model repository and place a malicious custom_generate/generate.py within it. Immediate arbitrary code execution is limited by the trust_remote_code gate that correctly fires after the file write; actual execution of the cached malicious module requires a subsequent model load that resolves against the poisoned cache entry without triggering a fresh consent check. Users who do not call load_custom_generate(), who only load models from verified repositories, or who routinely clear ~/.cache/huggingface/modules/ face negligible residual risk.

The provided CVSS 7.8 with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H overstates the impact in several dimensions. The attack vector is arguably AV:N, not AV:L: the attacker controls a remote model repository, and the victim fetches from it - however, user interaction is required (UI:R). C:H and A:H reflect the secondary, conditional threat of eventual code execution via cache poisoning rather than the confirmed direct impact, which is an unauthorized file write (I:H); the description explicitly states execution is correctly gated. EPSS of 0.11% at the 1st percentile confirms very low current exploitation probability. There is no CISA KEV listing and no public PoC. Real-world risk is moderate and largely confined to ML developers and researchers who call load_custom_generate() against third-party or untrusted model repositories. The cache-collision execution path requires a specific sequence - a poisoned cache entry surviving into a future trusted model load - which is plausible but not automatic. CVSS vector metric AV:L appears inconsistent with the described remote-repository attack scenario; verify with vendor.

An attacker publishes a malicious Hugging Face model repository containing a weaponized custom_generate/generate.py. A developer calls load_custom_generate() on this model; Transformers silently fetches and writes the malicious Python file to ~/.cache/huggingface/modules/ before presenting the trust prompt. Even if the user declines, the file persists and may be silently loaded in a future session when a trusted model triggers module cache resolution against the poisoned entry.