CVE-2026-5241
Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers
- Published
- Updated
- Reserved
- Assigned by
- @huntr_ai
Description
A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the `trust_remote_code` parameter, intended to prevent remote code execution, is overridden by untrusted serialized configuration data in a nested code path. Specifically, when loading a LightGlue model using `AutoModel.from_pretrained()` with `trust_remote_code=False`, the `LightGlueConfig` reads the `trust_remote_code` value from the untrusted `config.json` file and propagates it into nested `AutoConfig.from_pretrained()` calls. This results in the execution of attacker-provided Python modules, even when the victim explicitly disables remote code execution. The vulnerability poses a high risk for environments such as API inference servers, research notebooks, CI/CD pipelines, and model evaluation workers, potentially leading to credential theft, lateral movement, or persistence/backdoor deployment.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| @huntr_aiCNA (assigner) | 3.0 | High8.0 | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N |
| redhat-SADPADP (enrichment) | 3.1 | High7.7 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N |
| NVDNVD · Modified | 3.1 | Critical9.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.60% · top 51% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.0.
Weakness
Affected products
huggingface · huggingface/transformers
- affected unspecified – < 5.5.0
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- PyPItransformersGHSA-fgcw-684q-jj6r (opens in a new tab)
References (9)
- https://huntr.com/bounties/ceb3ce1a-4c45-497a-b25e-cb9a7685e619 (opens in a new tab)exploit
- https://github.com/huggingface/transformers/commit/676559d5022b74aaa0cee1cee0842b7f27c5320e (opens in a new tab)
- https://access.redhat.com/security/cve/CVE-2026-5241 (opens in a new tab)vdb-entryx_refsource_REDHAT
- RHBZ#2484384 (opens in a new tab)issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5241.json (opens in a new tab)x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:42644 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37275 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34456 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60520 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-fgcw-684q-jj6r (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-5241)Record last updated .