--- id: CVE-2026-5241 title: >- python-transformers: python-transformers: Arbitrary code execution due to overridden trust_remote_code setting (CVE-2026-5241) summary: >- A flaw was found in python-transformers. An attacker can exploit this vulnerability by providing a malicious model repository. During model initialization, the `trust_remote_code` parameter, intended to prevent remote code execution, is ov… severity: high cvss: 7.7 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N' cvssSource: vendor cwe: CWE-829 vendor: Red Hat product: Red Hat AI Inference Server 3.4 affected: - ai_inference_server - ansible_automation_platform 2 - enterprise_linux_ai_rhel_ai 3 - openshift_ai_rhoai - ai_inference_server 3.4 - openshift_ai 2.25 - openshift_ai 3.3 - openshift_ai 3.4 patched: - ai_inference_server 3.4 - openshift_ai 2.25 - openshift_ai 3.3 - openshift_ai 3.4 published: '2026-06-03' updated: '2026-09-24' sourceUpdated: '2026-09-24T05:55:17+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5241.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5241.json - url: 'https://access.redhat.com/security/cve/CVE-2026-5241' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2484384' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-5241' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-5241' - url: >- https://github.com/huggingface/transformers/commit/676559d5022b74aaa0cee1cee0842b7f27c5320e - url: 'https://huntr.com/bounties/ceb3ce1a-4c45-497a-b25e-cb9a7685e619' - url: 'https://access.redhat.com/errata/RHSA-2026:70996' - url: 'https://access.redhat.com/errata/RHSA-2026:69468' - url: 'https://access.redhat.com/errata/RHSA-2026:69466' - url: 'https://access.redhat.com/errata/RHSA-2026:70965' - url: 'https://access.redhat.com/errata/RHSA-2026:70979' - url: 'https://access.redhat.com/errata/RHSA-2026:69467' - url: 'https://access.redhat.com/errata/RHSA-2026:70995' - url: 'https://access.redhat.com/errata/RHSA-2026:69469' - url: 'https://access.redhat.com/errata/RHSA-2026:70969' - url: 'https://access.redhat.com/errata/RHSA-2026:69464' - url: 'https://access.redhat.com/errata/RHSA-2026:42644' - url: 'https://access.redhat.com/errata/RHSA-2026:37275' - url: 'https://access.redhat.com/errata/RHSA-2026:34456' - url: 'https://access.redhat.com/errata/RHSA-2026:60520' - url: 'https://github.com/huggingface/transformers' - url: >- https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2026-2290.yaml tags: - csaf - vex - red-hat - osv - pip epss: 0.00597 epssPercentile: 0.47232 aliases: - GHSA-fgcw-684q-jj6r - PYSEC-2026-2290 ecosystem: pip scores: vendor: 7.7 osv: 8 ingestedAt: '2026-07-13T18:57:57.338Z' --- ## Overview A flaw was found in python-transformers. An attacker can exploit this vulnerability by providing a malicious model repository. During model initialization, the `trust_remote_code` parameter, intended to prevent remote code execution, is overridden by untrusted configuration data. This allows the attacker to execute arbitrary code, potentially leading to credential theft, unauthorized access, or the deployment of backdoors. ## Vendor advisories - **RHSA-2026:70996** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70996) - **RHSA-2026:69468** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69468) - **RHSA-2026:69466** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69466) - **RHSA-2026:70965** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70965) - **RHSA-2026:70979** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70979) - **RHSA-2026:69467** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69467) - **RHSA-2026:70995** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70995) - **RHSA-2026:69469** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69469) - **RHSA-2026:70969** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70969) - **RHSA-2026:69464** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69464) - **RHSA-2026:42644** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:42644) - **Red Hat VEX** · Important · affected: Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5241.json) - **RHSA-2026:37275** · Red Hat · fixed in: Red Hat OpenShift AI 3.3 · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:37275) - **RHSA-2026:34456** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:34456) - **RHSA-2026:60520** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-08-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:60520) **python-transformers: python-transformers: Arbitrary code execution due to overridden trust_remote_code setting** — rated Important by Red Hat. Released 2026-06-03, updated 2026-09-24. Affected: - Red Hat AI Inference Server - Red Hat Ansible Automation Platform 2 - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat OpenShift AI (RHOAI) Fixed: - Red Hat AI Inference Server 3.4 - Red Hat OpenShift AI 2.25 - Red Hat OpenShift AI 3.3 - Red Hat OpenShift AI 3.4 No fix planned: - Red Hat AI Inference Server - Red Hat Ansible Automation Platform 2 - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat OpenShift AI (RHOAI) Not affected: - Red Hat OpenShift AI 2.25 - Red Hat OpenShift AI 3.3 - Red Hat OpenShift AI 3.4 - OpenShift Lightspeed - Red Hat Ansible Automation Platform 2 - Red Hat OpenShift AI (RHOAI) ## Remediation For more information visit https://access.redhat.com/errata/RHSA-2026:70996 https://access.redhat.com/errata/RHSA-2026:70996 For more information visit https://access.redhat.com/errata/RHSA-2026:69468 https://access.redhat.com/errata/RHSA-2026:69468 For more information visit https://access.redhat.com/errata/RHSA-2026:69466 https://access.redhat.com/errata/RHSA-2026:69466 Workarounds / mitigations: - Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. ## Package advisory (CVE-2026-5241) Affected packages: - `transformers < 5.5.0` Patched in: - `transformers 5.5.0` Source: https://osv.dev/vulnerability/GHSA-fgcw-684q-jj6r