EUVD-2026-34084
GHSA-fgcw-684q-jj6r
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
8Blast Radius
ecosystem impact- 33 pypi packages depend on transformers (20 direct, 14 indirect)
Ecosystem-wide dependent count for version 5.2.0.
DescriptionNVD
A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the trust_remote_code parameter, intended to prevent remote code execution, is overridden by untrusted serialized configuration data in a nested code path. Specifically, when loading a LightGlue model using AutoModel.from_pretrained() with trust_remote_code=False, the LightGlueConfig reads the trust_remote_code value from the untrusted config.json file and propagates it into nested AutoConfig.from_pretrained() calls. This results in the execution of attacker-provided Python modules, even when the victim explicitly disables remote code execution. The vulnerability poses a high risk for environments such as API inference servers, research notebooks, CI/CD pipelines, and model evaluation workers, potentially leading to credential theft, lateral movement, or persistence/backdoor deployment.
AnalysisAI
Remote code execution in Hugging Face Transformers 5.2.0 allows a malicious model repository to bypass the user's explicit trust_remote_code=False safeguard when loading a LightGlue model via AutoModel.from_pretrained(). The LightGlueConfig deserializes the trust_remote_code flag from the untrusted config.json and propagates the attacker-controlled value into a nested AutoConfig.from_pretrained() call, enabling execution of arbitrary attacker-supplied Python during model initialization. Rated CVSS 9.6 (AV:N/AC:L/PR:N/UI:R) with publicly available exploit code exists via the Huntr disclosure, though EPSS is currently 0.07% (22th percentile) and the CVE is not on CISA KEV.
Technical ContextAI
Hugging Face Transformers is the de facto Python library for loading and running pretrained ML models from the Hugging Face Hub. The trust_remote_code parameter is a critical security control that gates whether custom Python modules shipped alongside a model are imported and executed at load time; setting it to False is the documented way to refuse arbitrary code from a model repo. The root cause maps to CWE-829 (Inclusion of Functionality from Untrusted Control Sphere): LightGlueConfig defined trust_remote_code as a serialized config field with default False, so an attacker who controls config.json could override the user's runtime choice. The diff (commit 676559d) removes the trust_remote_code attribute from LightGlueConfig entirely, drops the dynamic AutoConfig.from_pretrained() branch for unknown keypoint detectors, and adds a new mlinter rule (TRF014) banning trust_remote_code inside native model integrations going forward. Affected CPE is cpe:2.3:a:huggingface:transformers:5.2.0; per the ENISA EUVD record the issue extends to all versions below 5.5.0.
RemediationAI
Vendor-released patch: upgrade huggingface/transformers to 5.5.0 or later, which removes the trust_remote_code attribute from LightGlueConfig and eliminates the nested AutoConfig.from_pretrained() call that consumed it (commit 676559d5022b74aaa0cee1cee0842b7f27c5320e). If immediate upgrade is not possible, restrict LightGlue model loading to repositories you control or have audited - specifically inspect each model's config.json for an injected trust_remote_code key before calling from_pretrained, and prefer pinning to a known-good revision SHA rather than a tag. As a stronger compensating control, run model-loading workers under a non-privileged user inside a sandbox (gVisor, Firecracker, or a container without outbound network) so that arbitrary Python execution cannot reach credentials or perform lateral movement; the trade-off is added operational complexity and potential breakage of legitimate models that need network access at load. Refer to the Huntr advisory at https://huntr.com/bounties/ceb3ce1a-4c45-497a-b25e-cb9a7685e619 for full disclosure details.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today