Hugging Face Transformers wrote remote code to disk before asking whether to trust it

What happened

CERT/CC reported that load_custom_generate() fetched and cached a remote repository’s custom_generate/generate.py before running the trust_remote_code consent check that gates every other code-loading path in the library. The file reached the local module cache even when the user declined the prompt.

The consent gate is the whole security model for remote code in Transformers, and this path ran it in the wrong order. Declining still left attacker-supplied code sitting in a cache directory the library imports from. CVSS 3.1 scores it 7.8 high across versions 4.49.0 through 5.8.1, and no patch was available at publication.