Three high-severity vulnerabilities have been discovered in Hugging Face's Diffusers library that enable malicious model repositories to execute arbitrary code on systems loading them, effectively bypassing the trust_remote_code security safeguard. These flaws expose significant risks in the AI supply chain by allowing attackers to compromise systems through seemingly legitimate AI model repositor
Three high-severity security flaws have been disclosed in Hugging Face's Diffusers library that could allow crafted model repositories to stealthily execute arbitrary code on machines that load it, opening the artificial intelligence (AI) supply chain to security risk. "These vulnerabilities are bypassing trust_remote_code, the safeguard designed to stop unreviewed code from running in the
Originally published at thehackernews.com
60-minute technical evaluation, no obligation. We'll map the ideas in this article to your environment.
