CVE-2026-5241 is an untrusted code inclusion flaw (CWE-829) in Hugging Face transformers 5.2.0, in LightGlue model loading. Settings in an attacker's config.json can override trust_remote_code=False and run Python from the model repository. It is scored 9.6 critical. Update transformers and load only models you trust.
What's affected
Hugging Face transformers 5.2.0, per the CVE record. The upstream fix is a commit that removes the trust_remote_code field from LightGlueConfig. I could not confirm a fixed release number from the pages I read, so check the project's release notes for the first version that includes the commit.
The record names the environments most at risk: API inference servers, research notebooks, CI/CD pipelines and model evaluation workers. In those places, loading a model from a repository you do not control is routine.
How to check if you're exposed
Read your version:
pip show transformers
pip freeze | grep -i transformers
Then look at where your code loads models. Search for calls that take a model name from user input, configuration or a hub search:
grep -rn "from_pretrained" --include=*.py .
Pay attention to LightGlue models and to any code path that loads a model from a name you do not control.
You can also run the free in-browser dependency scan or browse the Gold directory to see where this component shows up in your stack.
What to do now
- Find services, notebooks and pipelines that import transformers 5.2.0.
- Update to a release that contains the upstream fix, after reading the release notes.
- Load models only from sources you trust and pin them to a specific revision.
- Run model loading in a sandbox with no access to credentials and no outbound network where you can.
- Review pipelines that accept user chosen model names and restrict them to an allowlist.
- Rotate credentials that were available to workers that loaded unknown models.
Why it matters
The trust_remote_code option exists so that a caller can refuse to run Python code that ships with a model repository. The record says that LightGlue's configuration read this value from the untrusted config.json and passed it into nested calls. The data from the repository overrode the caller's explicit choice.
That is CWE-829, inclusion of functionality from an untrusted control sphere. A setting that guards code execution must never be readable from the thing it guards. The fix removes the field so the repository can no longer supply it.
The record lists credential theft, lateral movement and persistence as consequences in places such as CI. It does not report exploitation, and the CVE is not in the CISA KEV catalog. A model repository is code supply chain input, and should be handled like a dependency.
Quick check
If I set trust_remote_code to False, am I safe?
Not on the affected version for LightGlue. The record says the repository's config can override it.
Which release is fixed?
I could not confirm it from the pages I read. Check the transformers release notes for the version that includes the upstream commit.
Sources
Last reviewed: 19 October 2026.
