Executive brief
A security flaw in the Hugging Face Transformers library allows a malicious AI model to execute unauthorized code on a user's computer. This occurs even if the user has explicitly disabled the setting that allows remote code execution. An attacker could use this to steal credentials, gain a foothold in a corporate network, or disrupt automated AI pipelines.
Technical details
A vulnerability in the LightGlue model loading path of huggingface/transformers (specifically version 5.2.0 and others before 5.5.0) allows for arbitrary code execution. The root cause is a failure to properly enforce the 'trust_remote_code' security parameter. When a user loads a LightGlue model via 'AutoModel.from_pretrained()' with 'trust_remote_code=False', the 'LightGlueConfig' component incorrectly reads a 'trust_remote_code' value from the untrusted 'config.json' file within the model repository. This value is then propagated into nested 'AutoConfig.from_pretrained()' calls, overriding the user's safety preference and executing attacker-supplied Python modules. This can be exploited if a user is enticed to load a malicious model from a remote repository.
Affected products
- Hugging Face transformers < 5.5.0
Timeline
- 2026-03-31: patched: Fix committed to repository
- 2026-06-03: disclosed: Initial advisory publication
- 2026-07-13: advisory: Advisory updated and reviewed
References
- https://github.com/huggingface/transformers/commit/676559d5022b74aaa0cee1cee0842b7f27c5320e
- https://huntr.com/bounties/ceb3ce1a-4c45-497a-b25e-cb9a7685e619
- https://access.redhat.com/security/cve/CVE-2026-5241
- https://bugzilla.redhat.com/show_bug.cgi?id=2484384
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5241.json