PyPI/transformers CVE-2026-80047: high 7.8, EPSS 0.10%

Hugging Face Transformers downloads custom generation code before trust consent

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: PYSEC-2026-4174
• https://nvd.nist.gov/vuln/detail/CVE-2026-80047
• https://github.com/huggingface/transformers/pull/48620
• https://github.com/huggingface/transformers/commit/cbc1651a032b923da7f4b44b3d0e6f68e6ba6b55
• https://github.com/huggingface/transformers
• https://kb.cert.org/vuls/id/456290
• https://www.kb.cert.org/vuls/id/456290
• https://pypi.org/project/transformers
• https://github.com/advisories/GHSA-x9r9-c232-4q39

CVE-2026-80047 · published 2026-10-01T16:38:29.265731Z · modified 2026-10-01T17:45:18.547440485Z · JSON