Three flaws in Hugging Face's Diffusers library let crafted model repositories run arbitrary code despite trust_remote_code protections.