CVE-2026-80047
2 advisories.
PyPI/transformers CVE-2026-80047: high 7.8
Hugging Face Transformers downloads custom generation code before trust consent
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.49.0 | - | 5.8.1 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-x9r9-c232-4q39
- https://nvd.nist.gov/vuln/detail/CVE-2026-80047
- https://github.com/huggingface/transformers/pull/48620
- https://github.com/huggingface/transformers/commit/cbc1651a032b923da7f4b44b3d0e6f68e6ba6b55
- https://github.com/huggingface/transformers
- https://kb.cert.org/vuls/id/456290
- https://www.kb.cert.org/vuls/id/456290
CVE-2026-80047 · published · modified · JSON
PyPI/transformers CVE-2026-80047: high 7.8
Hugging Face Transformers downloads custom generation code before trust consent
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.49.0 | - | 5.8.1 |
Fixed versions
No fixed version in the source.
Sources
- osv: PYSEC-2026-4174
- https://nvd.nist.gov/vuln/detail/CVE-2026-80047
- https://github.com/huggingface/transformers/pull/48620
- https://github.com/huggingface/transformers/commit/cbc1651a032b923da7f4b44b3d0e6f68e6ba6b55
- https://github.com/huggingface/transformers
- https://kb.cert.org/vuls/id/456290
- https://www.kb.cert.org/vuls/id/456290
- https://pypi.org/project/transformers
- https://github.com/advisories/GHSA-x9r9-c232-4q39
CVE-2026-80047 · published · modified · JSON