Executive Summary
A critical remote code execution (RCE) vulnerability, identified as CVE-2026-4372, has been discovered in the Hugging Face Transformers library affecting versions prior to 5.3.0. The flaw resides in how the library deserializes model configuration files, specifically allowing the `_attn_implementation_internal` field to redirect code execution to an attacker-controlled repository. This bypasses the standard `trust_remote_code=False` security boundary, meaning users can be compromised even when they have explicitly disabled remote code execution.
Technically, the attack chain is triggered when a victim loads a malicious model using standard APIs like `AutoModelForCausalLM.from_pretrained()`. The configuration file influences internal kernel-loading logic, causing the library to download and execute arbitrary Python modules with the privileges of the local process. This highlights a significant shift in AI security, where model repositories must be treated as active software supply-chain inputs rather than passive data files.
The business impact is substantial for organizations utilizing automated AI evaluation pipelines, shared notebook environments, or CI/CD jobs that pull models from public hubs. If compromised, attackers could gain access to cloud credentials, internal datasets, and sensitive API tokens mounted in these environments. Immediate patching to Transformers v5.3.0+ is required, alongside a review of model intake policies.