Technical impact
A flaw in the LightGlue model loading mechanism of huggingface/transformers allows an attacker to execute arbitrary Python code during model initialization. The vulnerability falls under CWE-829. The bug stems from the trust_remote_code flag being overwritten by untrusted data in a nested configuration path, so even when the flag is set to False, malicious code can be loaded. This results in a high‑impact remote code execution vulnerability that can lead to credential theft, lateral movement, or persistence on systems that load untrusted models.
Affected Systems
The vulnerability affects the huggingface/transformers product, specifically versions that include the LightGlue implementation, with the issue documented in version 5.2.0. Users of earlier or subsequent releases that contain the fix are not affected. This includes any environment that loads LightGlue models via AutoModel.from_pretrained, such as API inference servers, research notebooks, CI/CD pipelines, and model evaluation workers.
Risk and Exploitability
The CVSS score is 9.6, indicating critical severity. The EPSS score is less than 1%, indicating a very low but nonzero exploitation probability. The lack of a KEV listing does not preclude active attacks. The vulnerability can be exploited by any party that can supply a model repository, either by hosting a malicious model or by coercing a user to load it. Because the trust_remote_code parameter is ultimately overridden by the model’s own configuration, the attack vector is a relatively simple supply‑chain attack that does not require privileged access or additional vulnerabilities.
Github GHSA