The vulnerability in huggingface/transformers 5.2.0 arises because the trust_remote_code parameter, which is intended to prevent remote code execution, is overridden by untrusted serialized configuration data in the LightGlue model loading path. Specifically, when loading a LightGlue model using AutoModel.from_pretrained() with trust_remote_code set to False, the LightGlueConfig reads the trust_remote_code value from the untrusted config.json file and propagates it into nested AutoConfig.from_pretrained() calls. This leads to execution of attacker-provided Python modules despite explicit disabling of remote code execution. The CVSS v3.0 score is 8.0, indicating high severity with network attack vector, high complexity, no privileges required, user interaction required, scope changed, and high confidentiality and integrity impact. The vulnerability poses risks in various environments that load models from potentially untrusted repositories.

Successful exploitation allows an attacker to execute arbitrary code during model initialization in huggingface/transformers 5.2.0. This can lead to credential theft, lateral movement within the victim environment, or deployment of persistence mechanisms or backdoors. The vulnerability affects any environment that loads LightGlue models from attacker-controlled repositories, including API inference servers, research notebooks, CI/CD pipelines, and model evaluation workers. The integrity and confidentiality of affected systems are severely impacted, while availability is not directly affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid loading LightGlue models from untrusted or unauthenticated sources. Explicitly verify the trustworthiness of model repositories before loading. Monitor vendor advisories, including the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-5241, for updates on patches or official mitigations.