CVE-2026-80047
HighAdvisory
Published 1 Sept 2026In the index since 1 Oct 2026
- Severity
- High
- worst across findings
- CVSS
- 7.8
- base score, highest
- EPSS
- 0.001
- 1st percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 4
- of 18,053 indexed, latest versions
- Container images
- 5
- deployed by those charts
- Fix available
- None
- affected package
Hugging Face Transformers downloads custom generation code before trust consent
Carried by container images the latest versions of 4 of 18,053 indexed charts deploy, on 5 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| transformerspypi | 4.52.4, 4.57.6, 5.5.0, 5.6.2 | no fix listed | 5 |
- OSV records
- GHSA-x9r9-c232-4q39
- Also known as
- PYSEC-2026-4174
Charts affected
4 by stars
Container images carrying it
5 by charts deploying them
A fixed version is listed for 0 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| aktosecurity/ | dbc566b2376c | transformers | no fix listed | 1 |
| langgenius/ | 097d3fd27a7b | transformers | no fix listed | 1 |
| langgenius/ | dcefa5f7c47c | transformers | no fix listed | 1 |
| mindsdb/ | 163011c09299 | transformers | no fix listed | 1 |
| rhasspy/ | 308b7959a925 | transformers | no fix listed | 1 |