A newly disclosed vulnerability in the Hugging Face Transformers library can cause attacker-controlled Python code to be written to a local system before a user decides whether to trust and execute ...