{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"4.49.0","last_affected":"5.8.1"}],"component":"transformers","cve_ids":["CVE-2026-80047"],"ecosystem":"PyPI","epss":0.00099,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-x9r9-c232-4q39","id":"tcs_01M5KHACWEDVT8EETCM7FYRM5D","modified_at":"2026-10-01T17:45:18.547440485Z","published_at":"2026-10-01T16:38:29.265731Z","references":["https://osv.dev/vulnerability/PYSEC-2026-4174","https://nvd.nist.gov/vuln/detail/CVE-2026-80047","https://github.com/huggingface/transformers/pull/48620","https://github.com/huggingface/transformers/commit/cbc1651a032b923da7f4b44b3d0e6f68e6ba6b55","https://github.com/huggingface/transformers","https://kb.cert.org/vuls/id/456290","https://www.kb.cert.org/vuls/id/456290","https://pypi.org/project/transformers","https://github.com/advisories/GHSA-x9r9-c232-4q39"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-4174","url":"https://osv.dev/vulnerability/PYSEC-2026-4174"}],"summary":"Hugging Face Transformers downloads custom generation code before trust consent"}