Hugging Face Transformers CVE-2026-5241

Victim must invoke AutoModel.from_pretrained() (or an equivalent loader) against an attacker-controlled or compromised model repository that advertises itself as a LightGlue keypoint-matching model and ships a config.json with trust_remote_code embedded as a serialized field. Exploitation specifically requires (a) Transformers version in the vulnerable range (5.2.0 per NVD CPE, <5.5.0 per EUVD), (b) the LightGlue code path - other model architectures are not affected by this particular bypass, and (c) UI:R per CVSS, meaning a human or automated job must initiate the load; the attacker does not need credentials or network position on the victim host. The bypass works even when the user explicitly passes trust_remote_code=False, which removes the most obvious limiting factor users would otherwise rely on. Exploitation is NOT possible against pipelines that only load fully vetted, locally hosted models or that pin to known-safe commit SHAs of trusted publishers.

Signals are mixed and need to be weighed together. CVSS 9.6 is justified by network attack vector, low complexity, no privileges, scope change (the user process is the only confused deputy and gets fully compromised), and high impact on C/I/A - UI:R reflects that a user must initiate the model load. SSVC marks technical impact as total but automatable as no and exploitation as PoC, which aligns with the Huntr bounty disclosure containing a working proof of concept. EPSS at 0.07% (22th percentile) is low, indicating no observed mass exploitation, and the CVE is NOT on CISA KEV. The realistic risk is high for any environment that loads third-party models from the Hub (research notebooks, inference servers, MLOps pipelines) because users were relying on trust_remote_code=False as a hard guarantee that this CVE proves untrustworthy; conversely, environments restricted to vetted internal models face limited exposure. Note that the NVD CPE only lists 5.2.0 while the EUVD says <5.5.0 - defenders should treat the broader EUVD range as authoritative until vendor confirms.

An attacker publishes (or compromises) a LightGlue-compatible model repository on the Hugging Face Hub whose config.json sets trust_remote_code: true and references a malicious custom keypoint-detector module. A data scientist or CI/CD pipeline running Transformers 5.2.0 loads the model with AutoModel.from_pretrained('attacker/lightglue-model', trust_remote_code=False), believing they are safe; LightGlueConfig overwrites the runtime flag from the config and Python in the attacker's module executes inside the victim process, enabling credential theft from environment variables, exfiltration of training data, or installation of a persistent backdoor. A proof of concept exists in the Huntr submission.