CVE-2026-5241: Policy Bypass in LightGlue Config Loading in Hugging Face Transformers

Overview

CVE-2026-5241 is a policy bypass in the LightGlue model loading path of huggingface/transformers. The trust_remote_code setting, which is meant to block remote code execution, can be overridden by untrusted serialized configuration data inside a nested loading path. The record describes this as a flaw in how nested configuration resolution respects the caller's policy.

Impact

• The record states that an attacker-controlled model repository can execute arbitrary code during model initialization.
• The record states that this can happen even when the victim explicitly sets trust_remote_code to False.
• The record lists possible consequences including credential theft, lateral movement and persistence or backdoor deployment.
• The record names API inference servers, research notebooks, CI/CD pipelines and model evaluation workers as high-risk environments.

Affected products and versions

• Product: Huggingface Transformers.
• The record lists version 5.2.0 as affected and an upper bound of before 5.5.0.
• Whether earlier releases are affected is not stated in the record.

Exploitation status

• The CVE is not listed in CISA KEV in the record, so no confirmed active exploitation is established by this analysis.
• The SSVC data in the record marks exploitation as proof of concept and automatable as no.
• One huntr bounty reference carries an Exploit tag, which indicates exploit-related material is referenced, but this does not confirm exploitation in the wild.

Remediation and mitigation

• Upgrade huggingface/transformers to a release at or beyond 5.5.0, which is the upper bound of the affected range in the record.
• Review the upstream patch commit referenced in the record to confirm the change applies to your deployment.
• Treat model repositories and their configuration files as untrusted input, and load models only from sources you control or have vetted.
• Isolate inference, notebook and CI workers that load third-party models, limiting their access to credentials and sensitive network segments.
• Check your vendor and distribution advisories, such as the Red Hat errata listed in the references, for packaged fixes.

Detection guidance

• Inventory systems where huggingface/transformers is installed and record the installed version.
• Log model downloads and model initialization events, and flag loads from repositories that are not on an approved list.
• Monitor for unexpected Python module imports or new processes started during model loading on worker hosts.

Limitations of the available information

• The record provides several CVSS scores from different providers, and they are not identical: 9.6 from NVD and 7.7 and 8 from other providers. The record does not explain the differences.
• The record does not state a fixed release explicitly; the 5.5.0 endpoint comes from the affected range.
• The record does not include a detailed technical root-cause analysis beyond the description.
• The EPSS value in the record is a probability estimate and does not confirm exploitation.

Frequently asked questions

What is the core problem in CVE-2026-5241?

According to the record, the trust_remote_code setting is overridden by untrusted configuration data in a nested LightGlue loading path, so code from an attacker-controlled repository can run even when the setting is False.

Which versions are affected?

The record lists version 5.2.0 as affected and gives an upper bound of before 5.5.0. It does not say whether older releases are affected.

Is this vulnerability known to be exploited in the wild?

No. The CVE is not listed in CISA KEV in the record, and the sources consulted do not confirm active exploitation.

What should administrators do now?

Upgrade to 5.5.0 or later, treat model repositories as untrusted, and isolate workers that load third-party models.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.