CERT/CC published vulnerability note VU#456290 on 1 September, covering CVE-2026-80047 in Hugging Face Transformers. In the note's own words, the library “performs a remote module fetch and local cache write before evaluating the trust_remote_code consent prompt, violating the security contract enforced across other dynamic module-loading” paths.
Where the ordering inverts
The affected path is load_custom_generate(), which calls get_cached_module_file() for a model repository's custom_generate/generate.py. That helper copies the file into the local HF_MODULES_CACHE. Only afterwards is resolve_trust_remote_code() consulted. Every other loading path — AutoConfig, AutoModel, AutoTokenizer — asks before touching disk.
What the common framing gets wrong
This will be written up as remote code execution in Transformers, and NVD's summary invites it by leading with “remote Python files”. It is not RCE on its own: declining the trust prompt still stops execution, because get_class_in_module() runs after the consent call. What you cannot decline is the file landing in your cache, where a later trusted load can collide with it. The impact is an unwanted write that outlives the session in which the user said no.
The version range points the wrong way
The advisory gives the affected range as 4.49.0 through 5.8.1, and the GitHub record's vulnerabilities array is empty, so no patched version is named. Reading that ceiling as “newer versions are clear” is the trap: the fetch-before-consent ordering is unchanged in v5.16.1, released 26 August — eight minor releases past the top of the stated range. The range records where testing stopped, not where the bug stops.
No vendor statement, four weeks on
CERT/CC records Hugging Face as notified on 4 August and, at publication on 1 September, lists vendor status Unknown with the line “We have not received a statement from the vendor.” No score is published either — neither GitHub nor CERT/CC assigns a CVSS. A 28-day gap between notification and publication with no vendor response is the disclosure story sitting beside the technical one.