🟠 High | Source: The Hacker News
Three high-severity vulnerabilities in Hugging Face’s Diffusers library allow malicious model repositories to execute arbitrary code on any machine that loads them, bypassing the trust_remote_code safety control intended to prevent this. This means developers or pipelines simply downloading and loading an AI model could silently compromise their environment. The risk extends across the AI/ML supply chain, affecting anyone using Diffusers in cloud-based training, inference, or MLOps workflows.
Security Architect’s Take: Audit all pipelines and compute environments that load Hugging Face Diffusers models and treat model ingestion as an untrusted code execution boundary — apply sandboxing (e.g. isolated containers or VMs with no lateral network access) and pin model versions with integrity checks. Prioritise patching to the latest Diffusers release and review your model provenance controls to ensure only vetted repositories are consumed.
Original advisory: Hugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Code