Diffusers treats a model repository as data until load time, and these flaws let that boundary fail. A repo a team meant to inspect can still cross into executable code during model loading, so the normal trust model for AI artifacts breaks inside pipelines, CI jobs, and containers.
Zafran reported three high-severity CVEs in Hugging Face diffusers that bypass trust_remote_code, and Hugging Face fixed them in diffusers 0.38.0. The issue affects vulnerable versions of a library with roughly seven million downloads a month, including production AI systems that pull third-party models.
The practical risk is not limited to one bad model file. If model loading can invoke attacker-controlled code, the repository itself becomes part of the software supply chain, and patching the library is only useful if teams also verify what they load and where they load it.