Hugging Face Transformers: huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue…
Hugging Face Transformers
More for Hugging Face Transformers RSS feed for Hugging Face Transformers
- Severity
- Critical, CVSS 9.6
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- Record
- CVE-2026-5241
- Affects
- Hugging Face Transformers
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 3, 2026
- Source last modified
- August 28, 2026
Description
A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the trust_remote_code parameter, intended to prevent remote code execution, is overridden by untrusted serialized configuration data in a nested code path. Specifically, when loading a LightGlue model using AutoModel.from_pretrained() with trust_remote_code=False, the LightGlueConfig reads the trust_remote_code value from the untrusted config.json file and propagates it into nested AutoConfig.from_pretrained() calls. This results in the execution of attacker-provided Python modules, even when the victim explicitly disables remote code execution. The vulnerability poses a high risk for environments such as API inference servers, research notebooks, CI/CD pipelines, and model evaluation workers, potentially leading to credential theft, lateral movement, or persistence/backdoor deployment.
Description quoted from the NVD record.
Who is affected
Hugging Face Transformers is a library that programs use to load and run machine learning (AI) models. This flaw affects version 5.2.0, in the part that loads LightGlue models. If someone at your organization loads a LightGlue model from a model repository controlled by an attacker, the attacker can run their code on that computer, even when the safety setting meant to block outside code is turned on. Servers that answer AI requests, research notebooks, automated build and test systems, and machines that test models are at high risk. An attacker could steal passwords and keys, reach other systems, or plant a hidden backdoor. This flaw is rated Critical.
What to do
- The person who installed or looks after the computers that run AI tools built with Hugging Face Transformers should handle this. If your organization uses an IT provider to manage those systems, the provider should handle it.
- Find out whether any of your computers or servers use version
5.2.0of thetransformerspackage. - No fixed version is named for this flaw yet, so check the vendor advisory linked on this page for a fixed release and install it as soon as one is available.
- If an IT provider or vendor runs these systems for your organization, send them this advisory and ask when the update will be done.
Analysis written from the source record as of August 28, 2026 and reviewed before publishing.