CVE-2026-5241: huggingface/transformers Arbitrary Code Execution During Model Initialization
Summary
CVE-2026-5241: A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. Affects transformers versions < 5.5.0. Fixed in 5.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The huggingface/transformers library is a widely used open-source package that provides state-of-the-art natural language processing models. It allows users to easily download and utilize pre-trained models for various tasks such as text classification, translation, and question answering. However, certain functionalities, like model loading, can expose users to security vulnerabilities if not properly managed.
Vulnerability Detail
A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the 'trust_remote_code' parameter, intended to prevent remote code execution, is overridden by untrusted serialized configuration data in a nested code path. Specifically, when loading a LightGlue model using AutoModel.from_pretrained() with trust_remote_code=False, the LightGlueConfig reads the trust_remote_code value from the untrusted config.json file and propagates it into nested AutoConfig.from_pretrained() calls. This results in the execution of attacker-provided Python modules, even when the victim explicitly disables remote code execution. The vulnerability poses a high risk for environments such as API inference servers, research notebooks, CI/CD pipelines, and model evaluation workers, potentially leading to credential theft, lateral movement, or persistence/backdoor deployment.
How To Fix
Latest published version: 5.20.2 as of 22 Oct 2026
pip install --upgrade "transformers==5.20.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.5.0
This is the first release that contains the fix.
pip install --upgrade "transformers==5.5.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the LightGlue model or any models that require the 'trust_remote_code' parameter until you can update to a patched version. Additionally, ensure that you are loading models from trusted sources only.
Conclusion
The CVE-2026-5241 vulnerability in the huggingface/transformers library poses significant risks due to arbitrary code execution during model initialization. Users are strongly advised to update to the latest version to protect their applications from potential exploitation.
See every vulnerability recorded for transformers →
FAQ
CVE-2026-5241 is a vulnerability in the huggingface/transformers library that allows arbitrary code execution during model initialization due to improper handling of the 'trust_remote_code' parameter.
The vulnerability affects huggingface/transformers version 5.2.0. It is recommended to upgrade to version 5.5.0 or later to mitigate the risk.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in your software. You can check your application's vulnerability status using the Vulert playground without any signup.
The vulnerability can lead to arbitrary code execution, which may result in credential theft, unauthorized access, lateral movement within networks, or deployment of backdoors.
If you cannot update the package right away, avoid using the LightGlue model and ensure that you only load models from trusted sources to minimize risk.
Related vulnerabilities
Recent vulnerabilities recorded for transformers.
