GHSA-j7w6-vpvq-j3gm: Duplicate Advisory: Diffusers has a `trust_remote_code` bypass via `custom_pipeline` and local custom components

The Diffusers library has a vulnerability where arbitrary code can be silently executed when loading a pipeline from HuggingFace Hub, bypassing the `trust_remote_code` security check. An attacker can craft a repository with custom code in a Python file that gets automatically executed during `DiffusionPipeline.from_pretrained()` without requiring the `trust_remote_code=True` parameter or any visible warning, allowing remote code execution (RCE, where an attacker runs commands on a system they don't own).