Skip to content
Fencer Vulns
high 8.0

CVE-2026-5241 json

Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers

published 2026-06-03 5 mo ago modified 2026-09-10 1 mo ago also GHSA-fgcw-684q-jj6r , PYSEC-2026-2290 , EUVD-2026-34084

cvss
8.0
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits
0
none known

Summary

A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the `trust_remote_code` parameter, intended to prevent remote code execution, is overridden by untrusted serialized configuration data in a nested code path. Specifically, when loading a LightGlue model using `AutoModel.from_pretrained()` with `trust_remote_code=False`, the `LightGlueConfig` reads the `trust_remote_code` value from the untrusted `config.json` file and propagates it into nested `AutoConfig.from_pretrained()` calls. This results in the execution of attacker-provided Python modules, even when the victim explicitly disables remote code execution. The vulnerability poses a high risk for environments such as API inference servers, research notebooks, CI/CD pipelines, and model evaluation workers, potentially leading to credential theft, lateral movement, or persistence/backdoor deployment.

Patch / fix

  • pypi transformers 5.5.0
  • huggingface huggingface/transformers 5.5.0
  • Red Hat Red Hat OpenShift AI 2.25 1782475830, 1783082430, 1783998418
  • Red Hat Red Hat OpenShift AI 3.3 1782471555, 1782471579, 1782471606, 1782471656, 1782471663, 1782991170, 1783069204, 1783073038
  • Red Hat Red Hat OpenShift AI 3.4 1782132163, 1782132167, 1782132207, 1782132236, 1782132240, 1782132286, 1782135346, 1782135464, 1782136276, 1786611435, 1786611822

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-5241 updated cvss 7.7

python-transformers: python-transformers: Arbitrary code execution due to overridden trust_remote_code setting

  • Red Hat AI Inference Server rhaii/vllm-tpu-rhel9, rhaiis/vllm-cpu-rhel9, rhaiis/vllm-tpu-rhel9, rhaii/vllm-gaudi-rhel9, rhaiis/vllm-cuda-rhel9, rhaiis/vllm-rocm-rhel9, +4 more
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Ansible Automation Platform 2 ansible-automation-platform-25/lightspeed-chatbot-rhel8, ansible-automation-platform-27/lightspeed-chatbot-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/bootc-aws-cuda-rhel9, rhelai3/bootc-gcp-cuda-rhel9, rhelai3/disk-image-cuda-rhel9, +2 more
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-vllm-cuda-rhel9, rhoai/odh-vllm-rocm-rhel9, rhoai/odh-caikit-nlp-rhel9, rhoai/odh-vllm-gaudi-rhel9, rhoai/odh-openvino-model-server-rhel9, rhoai/odh-kserve-storage-initializer-rhel9
    affected: workaround, no fix available
  • Red Hat AI Inference Server 3.4 rhaii/vllm-cpu-rhel9 1789681128, rhaii/vllm-cpu-rhel9 1790075793, rhaii/vllm-cuda-rhel9 1789681126, rhaii/vllm-cuda-rhel9 1790090131, rhaii/vllm-rocm-rhel9 1789681126, rhaii/vllm-rocm-rhel9 1790109620, +4 more
    fixed: vendor fix RHSA-2026:70996
  • Red Hat OpenShift AI 2.25 rhoai/odh-ta-lmes-job-rhel9 1791553527, rhoai/odh-built-in-detector-rhel9 1791364320, rhoai/odh-caikit-tgis-serving-rhel9 1783082430, rhoai/odh-training-rocm62-torch24-py311-rhel9 1782475830, rhoai/odh-training-rocm62-torch25-py311-rhel9 1782475830, rhoai/odh-training-cuda121-torch24-py311-rhel9 1783998418, +2 more
    fixed: vendor fix RHSA-2026:87410
  • Red Hat OpenShift AI 3.3 rhoai/odh-training-rocm62-torch24-py311-rhel9 1782471656, rhoai/odh-training-rocm62-torch25-py311-rhel9 1782471663, rhoai/odh-training-rocm64-torch28-py312-rhel9 1783069204, rhoai/odh-training-rocm64-torch29-py312-rhel9 1782991170, rhoai/odh-training-cuda121-torch24-py311-rhel9 1782471555, rhoai/odh-training-cuda124-torch25-py311-rhel9 1782471579, +3 more
    fixed: vendor fix RHSA-2026:37275
  • Red Hat OpenShift AI 3.4 rhoai/odh-automl-rhel9 1791535789, rhoai/odh-ta-lmes-job-rhel9 1791470318, rhoai/odh-built-in-detector-rhel9 1791537794, rhoai/odh-kserve-autogluon-server-rhel9 1791300023, rhoai/odh-th06-cpu-torch210-py312-rhel9 1782135464, rhoai/odh-th06-rocm64-torch291-py312-rhel9 1782135346, +10 more
    fixed: vendor fix RHSA-2026:84734
show 4 more
  • Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-ocp-rag-rhel9, openshift-lightspeed/lightspeed-service-api-rhel9, openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9
    not affected: component not present
  • Red Hat Ansible Automation Platform 2 ansible-automation-platform-26/lightspeed-chatbot-rhel9
    not affected: vulnerable code not present
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-autorag-rhel9, rhoai/odh-kserve-agent-rhel9, rhoai/odh-kserve-router-rhel9, rhoai/odh-llm-d-kv-cache-rhel9, rhoai/odh-llama-stack-core-rhel9, rhoai/odh-kserve-controller-rhel9, +7 more
    not affected: vulnerable code not in execute path
  • Red Hat OpenShift AI 2.25 rhoai/odh-rhel9-operator 1784004914, rhoai/odh-rhel9-operator 1792570619, rhoai/odh-vllm-cpu-rhel9 1782397826, rhoai/odh-vllm-cpu-rhel9 1792018436, rhoai/odh-dashboard-rhel9 1782826282, rhoai/odh-dashboard-rhel9 1791853525, +134 more Red Hat OpenShift AI 3.3 rhoai/odh-cli-rhel9 1782471642, rhoai/rhai-cli-rhel9 1782471642, rhoai/odh-mlflow-rhel9 1782917849, rhoai/odh-trainer-rhel9 1782471656, rhoai/odh-maas-api-rhel9 1782996644, rhoai/odh-mlserver-rhel9 1782887848, +68 more Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1782132151, rhoai/odh-cli-rhel9 1787330837, rhoai/odh-cli-rhel9 1791509689, rhoai/rhai-cli-rhel9 1782132151, rhoai/rhai-cli-rhel9 1787330837, rhoai/rhai-cli-rhel9 1791509689, +296 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
5 mo ago

Exploit prediction

0.60% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • huntr.com https://huntr.com/bounties/ceb3ce1a-4c45-497a-b25e-cb9a7685e619 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 8.0 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
CISA ADP 3.1 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
NVD 3.1 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CNA 3.1 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
OSV 3.1 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
GitHub 3.0 8.0 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
pypi transformers
<5.5.0
<=5.2.0
5.5.0

Affected products

  • huggingface huggingface/transformers
  • Red Hat Red Hat OpenShift AI 2.25
  • Red Hat Red Hat OpenShift AI 3.3
  • Red Hat Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Lightspeed
  • Red Hat Red Hat AI Inference Server
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Red Hat OpenShift AI (RHOAI)

Classification

Weakness
  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.