A vulnerability in the Hugging Face Transformers library allows unauthorized local file writes, posing a risk of persistent code injection and cache poisoning.

The function GenerativePreTrainedModel.load_custom_generate() performs an unconditional file write of remote modules to the local cache directory before verifying the user's trust consent. This behavior bypasses established security models, allowing attacker controlled Python files to persist on the host filesystem even if the user denies subsequent execution prompts.

This vulnerability carries a CVSS score of 7.8, indicating a high severity level. Successful exploitation allows an attacker to populate local cache directories with arbitrary files, which may lead to persistent unauthorized storage, cache collisions, or the potential for future execution of malicious code if the cache is later trusted. This represents a significant risk to the integrity of development and production environments utilizing these models.

Immediate Action: Upgrade to a version of Hugging Face Transformers that includes the patch for dynamic_module_utils.py as specified in the vendor advisory.

Proactive Monitoring: Review local cache directories, specifically the ~/.cache/huggingface/modules path, for unexpected or suspicious file modifications.

Compensating Controls: Implement strict filesystem permissions on cache directories to prevent unauthorized writes and utilize environment-level controls to restrict network access for processes performing model loading.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the high CVSS score and the nature of the flaw, organizations should prioritize updating their Transformers library instances immediately. Because the vulnerability involves persistent file writes that occur regardless of user consent, manual cleanup of the cache directory may be required following the software update to ensure no malicious artifacts remain on the system.