3 Diffusers CVEs let a Hugging Face model repo run code with trust_remote_code off
Zafran Security's FaceHugger research showed three ways a crafted Hugging Face repo runs Python during from_pretrained even when trust_remote_code is False. Here is the patch path and the policy.
Manu Shukla