Cybersecurity

The Fix Was Public 81 Days Before the Warning

A malicious config.json could run code on any machine loading a public AI model, bypassing trust_remote_code=False. The patch shipped 4 March. The CVE landed 24 May.

CybersecurityBy Servola Tech Desk2026-07-204 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

The Fix Was Public 81 Days Before the Warning

Key takeaways

CVE-2026-4372 let a public AI model run code on the machine that loaded it. The fix shipped in transformers 5.3.0 on 4 March 2026, but the CVE was not published until 24 May, so any team that patches from CVE feeds ran a known-fixed remote code execution for 81 extra days.
Check your transformers version this week. Every release from 4.56.0 on 29 August 2025 up to 5.2.x carried the vulnerable path when the kernels package was installed, a 187-day window in which the flaw was live and unreported.
Stop treating trust_remote_code=False as the control that covers you. The bypass ran through config.json, a metadata file the flag was never scoped to, using an underscore-prefixed field the loader wrote onto the config object with no allowlist.
Assume the machine that loads models holds your cloud keys. Hugging Face disclosed on 16 July that a malicious dataset reached a processing worker, then node access, then cloud and cluster credentials, then several internal clusters.
Read vendor release notes as security notices. This fix went out described as a kernels security issue, with no CVE, no severity rating and no mention of remote code execution, which is exactly why 81 days passed before most defenders had a reason to move.

A Configuration File Is Not Supposed to Run Anything

A developer at a European manufacturer pulls a model from a public hub, calls from_pretrained, and goes to lunch. The library fetches the weights, reads the JSON file that describes them, and initialises. Nothing in that sequence looks like consent to execute a stranger's code, and the developer has already set trust_remote_code to False so that it is not.

Security researchers at Pluto Security demonstrated that it was. The flaw is tracked as CVE-2026-4372, carries a CVSS base score of 7.8, and is classified under CWE-502, deserialization of untrusted data. It converts a routine model pull into arbitrary Python execution on the machine doing the pulling, and the user action required is nothing more than the documented way to load a model.

How a Metadata Field Walked Past the Flag

The flag guards code files. The attack arrived in metadata. The configuration constructor contained a loop that took every key and value from the untrusted JSON and wrote them onto the config object directly, with no allowlist and no validation. Among the fields an attacker could therefore set was one called _attn_implementation_internal, a private internal attribute nobody expected to be reachable from a downloaded file.

When that field held a string shaped like owner and repository, the kernel loader treated it as a package to fetch from the hub and imported it with no safety checks. Any Python placed in that repository's initialisation file then ran. The consent gate that developers rely on was never consulted, because it was scoped to custom modelling code and this was not custom modelling code. It was a settings file.

The Patch Arrived First. The Warning Took Another 81 Days

The dates are the story. The vulnerable code entered the library on 29 August 2025 and shipped in every release for roughly six months. The flaw was reported through a bug bounty on 23 February 2026, a maintainer opened the fix on 2 March, and version 5.3.0 closed it on 4 March. That is a fast and creditable response, ten days from report to patched release.

Then the public record went quiet. CVE-2026-4372 was not published until 24 May 2026, 81 days after the fix was already sitting in a public release. In that gap the patch was described in release notes as a kernels security issue, with no CVE number, no severity and no mention that it stopped remote code execution. Any operator whose patching is triggered by CVE feeds and vendor advisories, which is most regulated operators in Europe, had no signal to prioritise an upgrade that was already available.

Then the Hub Itself Was Breached Through the Same Class of Door

On 16 July 2026 Hugging Face disclosed an intrusion into part of its own production infrastructure. A malicious dataset abused two code-execution paths in dataset processing, a remote-code dataset loader and a template injection in a dataset configuration, to run on a processing worker. From there the intruder escalated to node access, harvested cloud and cluster credentials, and moved laterally into several internal clusters across a weekend. Forensics reviewed more than 17,000 recorded actions.

Hugging Face states it found no evidence of tampering with public models, datasets or Spaces, and verified its software supply chain clean. Treat the incident as proof of the escalation path rather than as a reason to distrust the hub. A file that describes data reached a worker, and the worker held credentials. That is the shape of the risk, and it is the same shape as the configuration flaw above.

What to Settle Before Your Next Model Pull

Three checks, in order. Confirm which version of transformers runs in your training images, your notebooks and your build agents, and upgrade anything below 5.3.0. Establish whether the kernels package is installed alongside it, since that is what made the path exploitable. Then look at what credentials sit on the machines that parse model and dataset artefacts, because those machines are usually treated as data plumbing and given broad access accordingly.

The reporting duty runs on its own clock regardless. Under Article 23 of NIS2 an in-scope entity owes its national authority an early warning within 24 hours of becoming aware of a significant incident, a fuller notification within 72 hours, and a final report within one month. In the United Kingdom the equivalent guidance comes from the NCSC. None of those deadlines pause while you work out which library version you were running.

Frequently asked questions

Am I affected if I never set trust_remote_code to True?

Possibly. The point of CVE-2026-4372 is that it bypassed that flag. The malicious instruction travelled in config.json, which the flag did not cover, so a developer who deliberately left trust_remote_code at False could still have code executed by loading a public model.

How do I know whether we were exploited rather than merely exposed?

Look for unexpected package downloads from the hub on machines that load models, and for outbound connections from those machines shortly after a model pull. Because the import happened inside a normal load, the useful evidence is network and package-fetch telemetry rather than an application error.

Is upgrading transformers to 5.3.0 or later enough?

It closes this path. Version 5.3.0 rejects the two internal attributes involved and requires explicit consent before loading kernel packages from outside the official organisation. It does not change the wider lesson that model and dataset artefacts are executable input and belong on machines with narrow credentials.

The library was patched in ten days. The warning took another 81, and that gap is the part you can actually control, because it is your own reading of a release note, not someone else's disclosure calendar.

CVE-2026-4372Hugging Facetransformerstrust_remote_codeRemote Code ExecutionNIS2AI supply chainPatch management

The nginx Patch Is Out, the Exploit Lands in August

CVE-2026-42533 affects nginx builds back to 2011. The fix shipped 15 July and a proof of concept is promised 21 days later. You can check your own exposure.

4 min read

Cybersecurity

A Bricked Building Costs More Than a Ransom

On 15 July 2026 CISA added CVE-2023-4346 to its KEV catalog. The KNX flaw has no patch. The fix is a commissioning setting, and the buildings are European.

5 min read

Law & Regulation

The EA Buyout Now Hinges on Brussels

The largest take-private in history has cleared EA shareholders and US antitrust. The last real gate is the EU - and not classic merger review, but the Foreign Subsidies Regulation, facing its first blockbuster test.

3 min read

← All articles