[Defilan]

The Remote code row names the Python a loader imports when the caller gives trust_remote_code. Two published transformers vulnerabilities run code from a field of config.json when the caller set trust_remote_code=False. The row read neither field, so a repository that used one with no .py file and no auto_map PASSed.

What it reads

Every config.json in the directory, at any depth. A composite model builds each sub-config from its dict the same way.

• A Hub kernel as the attention implementation (CVE-2026-4372).
  • Sources: NVD, Pluto Security's writeup, and the fix a7f8e7f.
  • PreTrainedConfig.__init__ applies every unknown key with setattr. That covers _attn_implementation_internal, and _attn_implementation, whose property setter writes the internal field.
  • A value that is_kernel takes for owner/repo[@rev][:fn] is downloaded and run when the model loads. This happens in 4.56.0 to 5.2.x once kernels is installed.
  • to_dict drops the internal field and never writes the property. So save_pretrained writes neither.
  • FAIL (config-kernel-injection, critical) for a kernel from any owner other than kernels-community.
  • LEAD (config-hub-kernel) for a kernels-community kernel. 5.3.0 and later still load those from _attn_implementation, without asking.
• trust_remote_code set in the config (CVE-2026-5241).
  • Sources: NVD and the fix 676559d, released in 5.5.0.
  • LightGlueConfig passed this field to the nested AutoConfig.from_pretrained for its keypoint detector. That imported another repository's code.
  • LEAD (config-trust-remote-code). The evidence names the repository that keypoint_detector_config._name_or_path points at.

Why FAIL for one and LEAD for the other

FAIL needs positive evidence.

• Attention field naming an outside kernel. Nothing legitimate writes that field. The field is the injection, whatever the kernel holds, and Socair cannot read code that lives in another repository.
• trust_remote_code: true. The published ETH-CVG/lightglue_disk sets it on purpose, and loaders other than LightGlue ignore it. So it is a lead for review, like auto_map.

Not read (stated in the package doc and the baseline)

• A top-level public attn_implementation: from_dict replaces it with the caller's own value.
• A public attn_implementation in a sub-config.
• trust_remote_code in tokenizer_config.json or sentence_bert_config.json: no loader's handling of those copies was read for this change.
• _experts_implementation*: 5.2.0 accepts only eager, grouped_mm, or batched_mm there, with no kernel path.

Measured: false positives

I scanned 403 real repositories with the gate from main and from this branch. JSON only, at pinned commits: the 400 most-downloaded and 100 most-liked transformers models on 2026-10-19, plus 48 named ones, including both LightGlue checkpoints.

SOCAIR_REMOTECODE_CORPUS="<dirs>" go test ./internal/checks/remotecode -run RealRepos -v

• Before and after: 357 PASS, 46 LEAD, 0 FAIL. No result changed.
• Across 2,227 JSON files, the only fields either rule reads are:
  • lightglue_disk's trust_remote_code: true, which adds a finding to a row that is already a LEAD through its auto_map;
  • Phi-4-multimodal's _attn_implementation: "flash_attention_2", which is not a kernel.
• No configuration names a Hub kernel anywhere. The FAIL rests on the published exploit; the corpus shows real configurations don't trip it.

The table is in docs/false-positive-baseline.md.

Tests and benchmark

• fields_test.go covers every shape the loader reads: internal and property field, sub-config, per-sub-config map, paged|, @rev:fn. It also covers the curated LEAD, the LightGlue LEAD, and the limits pinned as PASS. With overrides neutered, the four detection tests fail.
• Benchmark: dir-config-kernel-injection (FAIL), dir-config-trust-remote-code (LEAD), and the control control-dir-attention-field. Remote code now detects 10 of 11; overall 69 of 75; 0 of 18 controls flagged. Under tier1/0.11 both new cases PASSed.
• The corpus gate now accepts FAIL as well as LEAD for a repository with an auto_map.
• Check set tier1/0.12, with a row in docs/check-set.md. The Remote code PASS statement, "looks for" text, severities, and docs/dev.md are updated.

go test ./..., gofmt -l cmd internal, and go mod verify are clean.