Inclusion of Functionality from Untrusted Control Sphere in transformers - CVE-2026-5241

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists because the `trust_remote_code` parameter, intended to prevent remote code execution, is overridden by untrusted serialized configuration data in a nested code path. Specifically, when loading a LightGlue model using `AutoModel.from_pretrained()` with `trust_remote_code=False`, the `LightGlueConfig` reads the `trust_remote_code` value from the untrusted `config.json` file and propagates it into nested `AutoConfig.from_pretrained()` calls. A remote unauthenticated attacker can use the model repository to execute arbitrary code during model initialization.

Affected software

How to mitigate CVE-2026-5241

External References

• https://github.com/huggingface/transformers/commit/676559d5022b74aaa0cee1cee0842b7f27c5320e
• https://huntr.com/bounties/ceb3ce1a-4c45-497a-b25e-cb9a7685e619
• https://access.redhat.com/errata/RHSA-2026:34456
• https://access.redhat.com/errata/RHSA-2026:37275
• https://access.redhat.com/errata/RHSA-2026:42644
• https://access.redhat.com/security/cve/CVE-2026-5241
• https://bugzilla.redhat.com/show_bug.cgi?id=2484384
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5241.json

Related Security Bulletins

• Inclusion of Functionality from Untrusted Control Sphere in huggingface/transformers
• IBM Maximo Application Suite - Visual Inspection Component update for huggingface/transformers