The vulnerability arises in huggingface/transformers 5.2.0 within the LightGlue model loading path. When loading a LightGlue model via AutoModel.from_pretrained() with trust_remote_code set to false, the LightGlueConfig improperly reads the trust_remote_code value from an untrusted config.json file. This value then propagates into nested AutoConfig.from_pretrained() calls, allowing attacker-supplied Python modules to execute despite the user's explicit disabling of remote code execution. This CWE-829 issue (Inclusion of Functionality from Untrusted Control Sphere) enables arbitrary code execution from attacker-controlled model repositories, posing a significant risk in various deployment environments.

Successful exploitation allows arbitrary code execution during model initialization, which can lead to credential theft, lateral movement within networks, or deployment of persistent backdoors. The vulnerability undermines the security controls intended to prevent remote code execution in the transformers library, increasing the risk to systems that load models from untrusted sources.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid loading models from untrusted or unverified repositories, especially in sensitive environments. Explicitly verifying the source and integrity of model repositories before loading is recommended. Monitor the huggingface project advisories for updates or patches addressing this issue.