CVE-2026-5241 Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers
Attackers can execute arbitrary code via malicious model configs, bypassing trust_remote_code protections in the Hugging Face Transformers library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-5241?
CVE-2026-5241 is a high-severity code injection vulnerability in huggingface/transformers, published on 3 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the `trust_remote_code` parameter, intended to prevent remote code execution, is overridden by untrusted serialized configuration data in a nested code path. Specifically, when loading a LightGlue model using `AutoModel.from_pretrained()` with `trust_remote_code=False`, the `LightGlueConfig` reads the `trust_remote_code` value from the untrusted `config.json` file and propagates it into nested `AutoConfig.from_pretrained()` calls. This results in the execution of attacker-provided Python modules, even when the victim explicitly disables remote code execution. The vulnerability poses a high risk for environments such as API inference servers, research notebooks, CI/CD pipelines, and model evaluation workers, potentially leading to credential theft, lateral movement, or persistence/backdoor deployment.
Weakness: CWE-829
Which versions are affected by CVE-2026-5241?
3 open source packages ship an affected version, including transformers. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
transformers PyPI | All versions to 5.2.0 | None |
transformers PyPI | All versions | 5.5.0 |
transformers PyPI | All versions | 5.5.0 |
Products include Huggingface Transformers.
How do I fix CVE-2026-5241?
Upgrade transformers to 5.5.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-5241 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-5241 exists.
Other vulnerabilities in huggingface/transformers
- CVE-2023-7018 Deserialization of Untrusted Data in huggingface/transformers
- CVE-2023-6730 Deserialization of Untrusted Data in huggingface/transformers
- CVE-2024-11393 Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability
- CVE-2024-11394 Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability
- CVE-2026-4372 Arbitrary Remote Code Execution via `_attn_implementation_internal` Config Injection in huggingface/transformers
Sources
Also known as CLSA-2026-1783991041, ECHO-2ac7-0ae4-9836, GHSA-fgcw-684q-jj6r, PYSEC-2026-2290.