5 min read
News Brief Zafran Labs disclosed three CVEs in Hugging Face's Diffusers library collectively named FaceHugger, all rooted in a TOCTOU flaw that lets crafted model repositories bypass trust_remote_code protections and execute arbitrary code on machines loading them.