LightGlue Model Loading Bypasses Remote Code Execution Protections

A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the `trust_remote_code` parameter, intended to prevent remote code execution, is overridden by untrusted serialized configuration data in a nested code path. Specifically, when loading a LightGlue model using `AutoModel.from_pretrained()` with `trust_remote_code=False`, the `LightGlueConfig` reads the `trust_remote_code` value from the untrusted `config.json` file and propagates it into nested `AutoConfig.from_pretrained()` calls. This results in the execution of attacker-provided Python modules, even when the victim explicitly disables remote code execution. The vulnerability poses a high risk for environments such as API inference servers, research notebooks, CI/CD pipelines, and model evaluation workers, potentially leading to credential theft, lateral movement, or

Casky was already ahead

This CVE exploits attack patterns that Casky's 419matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-5241 represents a critical authentication bypass in the Hugging Face Transformers library (version 5.2.0) affecting the LightGlue model loading mechanism. The vulnerability allows attackers to execute arbitrary code during model initialization by exploiting a flaw where the `trust_remote_code=False` safety parameter is overridden by malicious serialized configuration data nested within the model loading path. This affects any organization using Transformers to load pretrained models from untrusted repositories, including ML teams, data scientists, and AI/ML platform operators who believe they are protected by explicitly disabling remote code execution. The critical 9.6 CVSS score reflects the ease of exploitation and complete system compromise potential.

Casky's 419 mapped security skills detect this attack through Claude's extended reasoning across three key MITRE ATT&CK techniques: Initial Access (TA0001) patterns involving malicious model repositories, Execution (TA0002) techniques detecting arbitrary code flow during deserialization, and Defense Evasion (TA0043) tactics identifying how the `trust_remote_code` parameter is bypassed. Practitioners using Casky would observe findings highlighting: (1) unsafe deserialization patterns in nested configuration loading paths, (2) parameter override behaviors that circumvent explicit security flags, and (3) code execution flowing from untrusted serialized data sources. The platform would flag attempts to load models from external repositories combined with configuration tampering, enabling detection before initialization completes and malicious code executes.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

419 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-5241.

analyzing-android-malware-with-apktool

malware analysis · medium

Run

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-bootkit-and-rootkit-samples

malware analysis · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-5241

Casky has 419 skills that investigate the attack patterns behind CVE-2026-5241. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn