PT-2026-45946 · Hugging Face · Transformers

Vasqu · Published 2026-06-03 · Updated 2026-06-04 · CVE-2026-5241

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions huggingface/transformers version 5.2.0

Description A flaw in the LightGlue model loading path allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue occurs because the trust remote code parameter, designed to prevent remote code execution, is overridden by untrusted serialized configuration data in a nested code path. Specifically, when using the AutoModel.from pretrained() function with trust remote code=False, the LightGlueConfig reads the trust remote code value from an untrusted config.json file and propagates it into nested AutoConfig.from pretrained() calls. This leads to the execution of attacker-provided Python modules even when remote code execution is explicitly disabled. This poses a high risk for API inference servers, research notebooks, CI/CD pipelines, and model evaluation workers, potentially resulting in credential theft, lateral movement, or the deployment of backdoors.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2026-5241

Affected Products

Transformers

References · 5

• 🔥 https://huntr.com/bounties/ceb3ce1a-4c45-497a-b25e-cb9a7685e619 · Exploit
• https://github.com/huggingface/transformers/commit/676559d5022b74aaa0cee1cee0842b7f27c5320e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-5241 · Security Note
• https://t.me/CVEtracker/55724 · Telegram Post
• https://twitter.com/TheRabbitPy/status/2062464194599924033 · Twitter Post