CGA-5c22-474v-68fg

CVE-2026-5241 (GHSA-fgcw-684q-jj6r, HIGH) is an arbitrary-code-execution flaw in the LightGlue model loading path of huggingface/transformers: LightGlueConfig reads the trust_remote_code value from an untrusted config.json and propagates it into a nested AutoConfig.from_pretrained() call, bypassing an explicit trust_remote_code=False. The vulnerable code resides entirely within the LightGlue model (src/transformers/models/lightglue/).

This package builds transformers 4.51.3, which predates the LightGlue model. LightGlue was first added to transformers in release 4.53.0 (upstream commit e5a9ce48f711, 2025-06-17); transformers 4.51.3 was released 2025-04-14. The LightGlue module is not present anywhere in the transformers 4.51.3 source tree, so the vulnerable code is not included in this package build. The upstream advisory's affected range (< 5.5.0) is broader than the set of versions that actually contain the vulnerable LightGlue code.

This package is therefore not affected by CVE-2026-5241. The flaw was fixed upstream in transformers 5.5.0 (commit 676559d).

References:

• https://nvd.nist.gov/vuln/detail/CVE-2026-5241
• https://github.com/advisories/GHSA-fgcw-684q-jj6r
• https://github.com/huggingface/transformers/pull/31718 (LightGlue model introduced; transformers 4.53.0)
• https://github.com/huggingface/transformers/commit/676559d5022b74aaa0cee1cee0842b7f27c5320e (upstream fix; transformers 5.5.0)