Copyright © 2012 Red Hat, Inc. All rights reserved.
Important
2026-06-03T12:33:10
python-transformers: python-transformers: Arbitrary code execution due to overridden trust_remote_code setting
7.7
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
CWE-829
A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the `trust_remote_code` parameter, intended to prevent remote code execution, is overridden by untrusted serialized configuration data in a nested code path. Specifically, when loading a LightGlue model using `AutoModel.from_pretrained()` with `trust_remote_code=False`, the `LightGlueConfig` reads the `trust_remote_code` value from the untrusted `config.json` file and propagates it into nested `AutoConfig.from_pretrained()` calls. This results in the execution of attacker-provided Python modules, even when the victim explicitly disables remote code execution. The vulnerability poses a high risk for environments such as API inference servers, research notebooks, CI/CD pipelines, and model evaluation workers, potentially leading to credential theft, lateral movement, or persistence/backdoor deployment.
A flaw was found in python-transformers. An attacker can exploit this vulnerability by providing a malicious model repository. During model initialization, the `trust_remote_code` parameter, intended to prevent remote code execution, is overridden by untrusted configuration data. This allows the attacker to execute arbitrary code, potentially leading to credential theft, unauthorized access, or the deployment of backdoors.
This Important vulnerability in `python-transformers` allows for arbitrary code execution when loading a malicious LightGlue model, even if `trust_remote_code` is explicitly set to `False`. This occurs because untrusted serialized configuration data can override the security setting in nested model loading paths. Red Hat products utilizing `python-transformers` for AI/ML workloads, such as Red Hat AI Inference Server and Red Hat OpenShift AI, are affected, posing a significant risk of credential theft or system compromise if untrusted models are processed. The LightGlue model (and its vulnerable trust_remote_code handling) was introduced in transformers 4.53.0 and fixed in 5.5.0; the CNA-published affected range is all versions before 5.5.0.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Red Hat OpenShift AI 2.25
2026-07-21T00:00:00Z
RHSA-2026:42644
rhoai/odh-caikit-tgis-serving-rhel9:1783082430
Red Hat OpenShift AI 2.25
2026-07-21T00:00:00Z
RHSA-2026:42644
rhoai/odh-training-cuda121-torch24-py311-rhel9:1783998418
Red Hat OpenShift AI 2.25
2026-07-21T00:00:00Z
RHSA-2026:42644
rhoai/odh-training-cuda124-torch25-py311-rhel9:1783998418
Red Hat OpenShift AI 2.25
2026-07-21T00:00:00Z
RHSA-2026:42644
rhoai/odh-training-rocm62-torch24-py311-rhel9:1782475830
Red Hat OpenShift AI 2.25
2026-07-21T00:00:00Z
RHSA-2026:42644
rhoai/odh-training-rocm62-torch25-py311-rhel9:1782475830
Red Hat OpenShift AI 3.3
2026-07-09T00:00:00Z
RHSA-2026:37275
rhoai/odh-training-cuda121-torch24-py311-rhel9:1782471555
Red Hat OpenShift AI 3.3
2026-07-09T00:00:00Z
RHSA-2026:37275
rhoai/odh-training-cuda124-torch25-py311-rhel9:1782471579
Red Hat OpenShift AI 3.3
2026-07-09T00:00:00Z
RHSA-2026:37275
rhoai/odh-training-cuda128-torch28-py312-rhel9:1783073038
Red Hat OpenShift AI 3.3
2026-07-09T00:00:00Z
RHSA-2026:37275
rhoai/odh-training-cuda128-torch29-py312-rhel9:1782991170
Red Hat OpenShift AI 3.3
2026-07-09T00:00:00Z
RHSA-2026:37275
rhoai/odh-training-rocm62-torch24-py311-rhel9:1782471656
Red Hat OpenShift AI 3.3
2026-07-09T00:00:00Z
RHSA-2026:37275
rhoai/odh-training-rocm62-torch25-py311-rhel9:1782471663
Red Hat OpenShift AI 3.3
2026-07-09T00:00:00Z
RHSA-2026:37275
rhoai/odh-training-rocm64-torch28-py312-rhel9:1783069204
Red Hat OpenShift AI 3.3
2026-07-09T00:00:00Z
RHSA-2026:37275
rhoai/odh-training-rocm64-torch29-py312-rhel9:1782991170
Red Hat OpenShift AI 3.3
2026-07-09T00:00:00Z
RHSA-2026:37275
rhoai/odh-trustyai-nemo-guardrails-server-rhel9:1782471606
Red Hat OpenShift AI 3.4
2026-07-01T00:00:00Z
RHSA-2026:34456
rhoai/odh-th06-cpu-torch210-py312-rhel9:1782135464
Red Hat OpenShift AI 3.4
2026-07-01T00:00:00Z
RHSA-2026:34456
rhoai/odh-th06-cuda130-torch210-py312-rhel9:1782136276
Red Hat OpenShift AI 3.4
2026-07-01T00:00:00Z
RHSA-2026:34456
rhoai/odh-th06-rocm64-torch291-py312-rhel9:1782135346
Red Hat OpenShift AI 3.4
2026-07-01T00:00:00Z
RHSA-2026:34456
rhoai/odh-training-cuda121-torch24-py311-rhel9:1782132167
Red Hat OpenShift AI 3.4
2026-07-01T00:00:00Z
RHSA-2026:34456
rhoai/odh-training-cuda124-torch25-py311-rhel9:1782132207
Red Hat OpenShift AI 3.4
2026-07-01T00:00:00Z
RHSA-2026:34456
rhoai/odh-training-cuda128-torch29-py312-rhel9:1782132240
Red Hat OpenShift AI 3.4
2026-07-01T00:00:00Z
RHSA-2026:34456
rhoai/odh-training-rocm62-torch24-py311-rhel9:1782132286
Red Hat OpenShift AI 3.4
2026-07-01T00:00:00Z
RHSA-2026:34456
rhoai/odh-training-rocm62-torch25-py311-rhel9:1782132236
Red Hat OpenShift AI 3.4
2026-07-01T00:00:00Z
RHSA-2026:34456
rhoai/odh-training-rocm64-torch28-py312-rhel9:1782132163
OpenShift Lightspeed
Not affected
openshift-lightspeed/lightspeed-ocp-rag-rhel9
OpenShift Lightspeed
Not affected
openshift-lightspeed/lightspeed-service-api-rhel9
OpenShift Lightspeed
Not affected
openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9
Red Hat AI Inference Server
Affected
rhaii/model-opt-cuda-rhel9
Red Hat AI Inference Server
Affected
rhaiis/model-opt-cuda-rhel9
Red Hat AI Inference Server
Will not fix
rhaiis/vllm-cpu-rhel9
Red Hat AI Inference Server
Affected
rhaiis/vllm-cuda-rhel9
Red Hat AI Inference Server
Will not fix
rhaiis/vllm-neuron-rhel9
Red Hat AI Inference Server
Affected
rhaiis/vllm-rocm-rhel9
Red Hat AI Inference Server
Will not fix
rhaiis/vllm-spyre-rhel9
Red Hat AI Inference Server
Will not fix
rhaiis/vllm-tpu-rhel9
Red Hat AI Inference Server
Affected
rhaii/vllm-cpu-rhel9
Red Hat AI Inference Server
Affected
rhaii/vllm-cuda-rhel9
Red Hat AI Inference Server
Will not fix
rhaii/vllm-gaudi-rhel9
Red Hat AI Inference Server
Will not fix
rhaii/vllm-neuron-rhel9
Red Hat AI Inference Server
Affected
rhaii/vllm-rocm-rhel9
Red Hat AI Inference Server
Affected
rhaii/vllm-spyre-rhel9
Red Hat AI Inference Server
Will not fix
rhaii/vllm-tpu-rhel9
Red Hat Ansible Automation Platform 2
Will not fix
ansible-automation-platform-25/lightspeed-chatbot-rhel8
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/lightspeed-chatbot-rhel9
Red Hat Ansible Automation Platform 2
Affected
ansible-automation-platform-27/lightspeed-chatbot-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Will not fix
rhelai3/bootc-aws-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Will not fix
rhelai3/bootc-azure-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Will not fix
rhelai3/bootc-azure-rocm-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Will not fix
rhelai3/bootc-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Will not fix
rhelai3/bootc-gaudi-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Will not fix
rhelai3/bootc-gcp-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Will not fix
rhelai3/bootc-rocm-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Will not fix
rhelai3/disk-image-cuda-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-automl-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-autorag-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-built-in-detector-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-caikit-nlp-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-guardrails-detector-huggingface-runtime-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-kserve-agent-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-kserve-autogluon-server-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-kserve-controller-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-kserve-router-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-kserve-storage-initializer-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-llama-stack-core-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-llm-d-inference-scheduler-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-llm-d-kv-cache-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-openvino-model-server-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-ta-lmes-job-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-cpu-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-cuda130-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-vllm-cuda-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-vllm-gaudi-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-vllm-rocm-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9
https://www.cve.org/CVERecord?id=CVE-2026-5241
https://nvd.nist.gov/vuln/detail/CVE-2026-5241
https://github.com/huggingface/transformers/commit/676559d5022b74aaa0cee1cee0842b7f27c5320e
https://huntr.com/bounties/ceb3ce1a-4c45-497a-b25e-cb9a7685e619