Package
py3.12-transformers-4.56
Component
transformers
Latest update
7.7
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
transformers 4.56.2 (the newest release on the 4.56 series) is affected by GHSA-fgcw-684q-jj6r / CVE-2026-5241: during LightGlue model initialization, a trust_remote_code value embedded in a model's config.json can override the caller's trust_remote_code=False and reach AutoConfig.from_pretrained() on an attacker-controlled path, allowing arbitrary code execution when loading a malicious model. Upstream fixed this in transformers 5.5.0 by removing the remote-code path from LightGlue loading (https://github.com/huggingface/transformers/pull/45122, commit 676559d5022b). The patch was written against the 5.x LightGlue configuration layer and does not apply cleanly to the 4.56 codebase (the LightGlueConfig structure was reworked between 4.56.2 and the fix base). Upstream has not published a fixed release on the 4.x line — the 4.56 series ends at 4.56.2, and no 4.x release has shipped since the advisory was published (2026-06-03). A fix for this version stream requires an upstream release on the 4.56 line.
Status