{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"5.2.0"}],"component":"transformers","cve_ids":["CVE-2026-5241"],"ecosystem":"PyPI","epss":0.00597,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-fgcw-684q-jj6r","id":"tcs_01M5KGYK23Y5PYX3A51T7ACYG5","modified_at":"2026-07-23T15:00:26.322865889Z","published_at":"2026-06-03T14:16:46.337Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2290","https://access.redhat.com/security/cve/CVE-2026-5241","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5241.json","https://access.redhat.com/errata/RHSA-2026:34456","https://access.redhat.com/errata/RHSA-2026:37275","https://bugzilla.redhat.com/show_bug.cgi?id=2484384","https://github.com/huggingface/transformers/commit/676559d5022b74aaa0cee1cee0842b7f27c5320e","https://huntr.com/bounties/ceb3ce1a-4c45-497a-b25e-cb9a7685e619","https://github.com/advisories/GHSA-fgcw-684q-jj6r"],"severity":{"label":"critical","score":9.6},"sources":[{"source":"osv","source_id":"PYSEC-2026-2290","url":"https://osv.dev/vulnerability/PYSEC-2026-2290"}],"summary":"A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The"}