# CVE-2026-5241: Hugging Face Transformers RCE in LightGlue model loading

Source: https://junglewise.ai/threats/cve-2026-5241-hugging-face-transformers-rce-in-lightglue-model-loading  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-03. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-5241 · Severity: high · CVSS 8 · Published 2026-06-03

A security flaw in the Hugging Face Transformers library allows a malicious AI model to execute unauthorized code on a user's computer. This occurs even if the user has explicitly disabled the setting that allows remote code execution. An attacker could use this to steal credentials, gain a foothold in a corporate network, or disrupt automated AI pipelines.

Technologies: [Hugging Face Transformers](https://junglewise.ai/threats/technologies/transformers), [transformers (PyPI)](https://junglewise.ai/threats/technologies/pypi-transformers). Vendors: [Hugging Face](https://junglewise.ai/threats/vendors/hugging-face), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-5241 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5241 being exploited in the wild.

**How severe is CVE-2026-5241?** High severity, with a CVSS score of 8, published 3 June 2026.

**Which products and versions are affected?** Hugging Face Transformers < 5.5.0, 5.2.0; transformers (PyPI) ECOSYSTEM:introduced=0,fixed=5.5.0, ECOSYSTEM:introduced=0,last_affected=5.2.0.

**Is there a fix for CVE-2026-5241?** Yes. transformers (PyPI): upgrade to 5.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-5241 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-5241?** Check whether you run Hugging Face Transformers or transformers (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- transformers (PyPI): upgrade to 5.5.0 or later

  ```sh
  pip install "transformers>=5.5.0"
  ```


## Technical details

A vulnerability in the LightGlue model loading path of huggingface/transformers (specifically version 5.2.0 and others before 5.5.0) allows for arbitrary code execution. The root cause is a failure to properly enforce the 'trust_remote_code' security parameter. When a user loads a LightGlue model via 'AutoModel.from_pretrained()' with 'trust_remote_code=False', the 'LightGlueConfig' component incorrectly reads a 'trust_remote_code' value from the untrusted 'config.json' file within the model repository. This value is then propagated into nested 'AutoConfig.from_pretrained()' calls, overriding the user's safety preference and executing attacker-supplied Python modules. This can be exploited if a user is enticed to load a malicious model from a remote repository.

## Affected products

- Hugging Face transformers < 5.5.0

## Identifiers

- CVE-2026-5241
- GHSA-fgcw-684q-jj6r
- PYSEC-2026-2290

## Timeline

- 2026-03-31: patched: Fix committed to repository
- 2026-06-03: disclosed: Initial advisory publication
- 2026-07-13: advisory: Advisory updated and reviewed

## References

- [https://github.com/huggingface/transformers/commit/676559d5022b74aaa0cee1cee0842b7f27c5320e](https://github.com/huggingface/transformers/commit/676559d5022b74aaa0cee1cee0842b7f27c5320e)
- [https://huntr.com/bounties/ceb3ce1a-4c45-497a-b25e-cb9a7685e619](https://huntr.com/bounties/ceb3ce1a-4c45-497a-b25e-cb9a7685e619)
- [https://access.redhat.com/security/cve/CVE-2026-5241](https://access.redhat.com/security/cve/CVE-2026-5241)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2484384](https://bugzilla.redhat.com/show_bug.cgi?id=2484384)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5241.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5241.json)

## Related threats

- [Hugging Face Transformers arbitrary file write via load_custom_generate](https://junglewise.ai/threats/cve-2026-80047-hugging-face-transformers-arbitrary-file-write-via-load-custom)
- [Hugging Face Transformers path traversal in save_pretrained](https://junglewise.ai/threats/cve-2026-9856-hugging-face-transformers-path-traversal-in-save-pretrained)
- [Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer](https://junglewise.ai/threats/cve-2025-6921-hugging-face-transformers-vulnerable-to-regular-expression-denial)
- [PYSEC-2026-1988 - Hugging Face Transformers library has Regular Expression Denial of Service](https://junglewise.ai/threats/cve-2025-6051-hugging-face-transformers-library-has-regular-expression-denial-of)
- [PYSEC-2026-1981 - Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer](https://junglewise.ai/threats/cve-2025-6638-hugging-face-transformers-is-vulnerable-to-redos-through-its)