trust_remote_code

How it works

A Hugging Face model repository usually holds weights and a config.json. The library has the code for the architecture. A custom model also holds its own Python files, for example modeling_*.py and configuration_*.py.

The auto_map entry in the configuration tells the Auto classes which repository class to use. With trust_remote_code=True, the loader does these steps:

1. Read config.json and find auto_map.
2. Download the Python files that auto_map names.
3. Import them. This runs their code on your host.
4. Make the model from those classes and load the weights.

When the flag is not set, Transformers asks: “Do you wish to run the custom code? [y/N]”. With no answer in 15 seconds, or with no terminal, the load stops with an error.

Why it matters

The Transformers documentation says the flag “will execute code present on the Hub on your local machine”. The code runs with the rights of your process. In practice, the risks are these:

• Read your secrets. The code can read cloud keys, Hub tokens and files on the host.
• Change after you read it. The repository owner can push new code. Without a pinned revision, the next load gets it.
• Pass the scan. The Hub runs ClamAV on files smaller than 2 GB at each commit. A virus scanner does not judge the intent of new Python code.

In practice

Hugging Face gives two controls in its own documentation:

Control	What it does	What it does not do
Read the code first	Finds malicious code before you run it	Stops a change of the code after you read it
revision=<commit hash>	Fixes the code to the version you read	Checks that version for you
code_revision	Pins code that lives in a different repository	Pins the weights

A safe load of a custom model has these parts:

1. Read the Python files of the repository, and of each repository that auto_map names.
2. Pin the commit hash with revision.
3. Use Safetensors weights, not Pickle weights. Pickle weights can also run code.
4. Load in a sandbox with no secrets and only the network access that is necessary.

The Hugging Face datasets library is different. Its version 4.0.0 (9 July 2025) removed dataset scripts. Its release notes say “trust_remote_code is no longer supported”.

Where the flag did not stop the code

These advisories show code that ran when the user did not let it run. Each score is the CVSS 3.1 or 3.0 score of the advisory.

Library	CVE	Published	Fixed in	CVSS	Cause
vLLM	CVE-2025-66448	1 Dec 2025	0.11.1	7.1	A config class resolved auto_map with the flag False
vLLM	CVE-2026-22807	21 Jan 2026	0.14.0	8.8	auto_map modules loaded with no check of the flag
vLLM	CVE-2026-27893	26 Mar 2026	0.18.0	8.8	Two model files set the flag to True in code
Diffusers	CVE-2026-44513	1 May 2026	0.38.0	8.8	custom_pipeline skipped the check
Transformers	CVE-2026-4372	26 May 2026	5.3.0	7.8	A crafted config.json ran code

The Cloud Security Alliance gives one root cause for the three Diffusers defects (CVE-2026-44513, CVE-2026-44827, CVE-2026-45804). The trust check is in one part of the code. The code that runs custom modules is in a different part, downstream.

For a security team, a model load from an untrusted repository is code execution, whatever the value of the flag. Keep model provenance records and check AI artifacts before the load, as for all AI supply chain compromise risks.

Questions and answers

Is trust_remote_code=True safe if the repository uses safetensors?

No. Safetensors keeps the weights file from running code, but trust_remote_code=True runs the Python files of the repository. These are two different paths. Read the Python files, pin the commit hash with the revision argument, and run the load in an isolated environment.

Does trust_remote_code=False always stop remote code?

Not always. From December 2025 to March 2026, vLLM had three advisories of this type. Diffusers (fixed in 0.38.0, May 2026) and Transformers (fixed in 5.3.0) had the same type of bypass. Keep the libraries patched. Do not load untrusted repositories on hosts with secrets.

Why does a model need trust_remote_code at all?

Some models use an architecture that the library does not include at this time. The model author puts the model code in the repository. The loader must import that code to make the model.