The vulnerability in huggingface/transformers 5.2.0 involves the LightGlue model loading mechanism where the 'trust_remote_code' parameter, designed to prevent remote code execution, is overridden by untrusted serialized configuration data in nested calls. Specifically, when loading a LightGlue model with 'AutoModel.from_pretrained()' and 'trust_remote_code' set to false, the 'LightGlueConfig' reads this parameter from an attacker-controlled 'config.json' file, propagating it into nested 'AutoConfig.from_pretrained()' calls. This results in execution of arbitrary attacker-provided Python code despite explicit disabling of remote code execution. The vulnerability affects all versions prior to 5.5.0, with the LightGlue model introduced in 4.53.0. Red Hat advisories confirm the vulnerability affects their AI/ML products and note no current mitigation meets their standards. The CVSS v3 score is 8.0, indicating high severity, with network attack vector, high attack complexity, no privileges required, user interaction required, and scope changed. The impact includes potential credential theft, unauthorized access, and deployment of backdoors.

Successful exploitation allows an attacker to execute arbitrary code during model loading, potentially leading to credential theft, unauthorized system access, lateral movement, and deployment of persistent backdoors. This risk is especially critical in environments processing untrusted models such as API inference servers, research notebooks, CI/CD pipelines, and model evaluation workers. The vulnerability compromises confidentiality and integrity but does not impact availability.

A fix is available in huggingface/transformers version 5.5.0 and later, which corrects the handling of the 'trust_remote_code' parameter to prevent override by untrusted configuration data. Users should upgrade to version 5.5.0 or newer to remediate this vulnerability. Currently, Red Hat states that no mitigation meeting their criteria for ease of use, applicability, and stability is available. Therefore, upgrading to a fixed version is the recommended remediation. Avoid loading untrusted LightGlue models until patched.