CVE-2026-5241
A flaw in huggingface transformers 5.2.0 lets an attacker-controlled model repository run arbitrary code when a LightGlue model is loaded, even if the trust_remote_code flag is set to False. The bug occurs because the flag is overridden by untrusted configuration data in a nested code path. This can allow attackers to execute code on the host system.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
huggingface transformers 5.2.0, commonly used in API inference servers, research notebooks, CI/CD pipelines, and model evaluation workers.
Real-world impact
An attacker could run arbitrary code on the system that loads the model, potentially stealing credentials, moving laterally, or installing a persistent backdoor.
Why this severity
The CVSS score of 9.6 reflects the high impact on confidentiality, integrity, and availability, the fact that the vulnerability can be exploited remotely without authentication, and that it requires only low attack complexity and minimal user interaction.
What to do about it
- ›Avoid loading models from untrusted repositories or sources.
- ›Use only trusted model repositories and verify the model’s integrity before loading.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
NVD description
Timeline
- Jun 3, 2026 · Jun 3, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- github.com/huggingface/transformers/co…patch
- huntr.com/bounties/ceb3ce1a-4c45-497a…exploitthird party advisory
- access.redhat.com/errata/RHSA-2026:34456
- access.redhat.com/errata/RHSA-2026:37275
- access.redhat.com/errata/RHSA-2026:42644
- access.redhat.com/security/cve/CVE-2026-5241
- bugzilla.redhat.com/show_bug.cgi
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2…