AIThe Hacker Newsabout 3 hours ago
Hugging Face Diffusers Flaws Allow Arbitrary Code Execution
1 min read
Three high-severity flaws in Hugging Face's Diffusers library let crafted model repositories bypass trust_remote_code and execute arbitrary code. The vulnerabilities, disclosed by Zafran Labs, were fixed in Diffusers version 0.38.0. The package has over 8.1 million downloads in July 2026.
Level
Hype check
Tap to vote and see what everyone thinks.
Summary by ByteBrief
