Hugging Face Transformers writes custom generated code before trust confirmation

Hugging Face Transformers 4.49.0 through 5.8.1 has a vulnerability where calling GenerativePreTrainedModel.load_custom_generate() fetches and caches remote Python module files before the user confirms trust_remote_code. Attacker-controlled custom_generate/generate.py code is written to the ~/.cache/huggingface/modules directory even if the user rejects the trust prompt. The execution step is still restricted by the trust check, but the file write is irreversible and persists across sessions, potentially causing unauthorized files persisted on disk, as well as cache conflicts leading to attacker code being executed in subsequent trusted model loads.