A critical remote code execution flaw in Hugging Face Transformers bypassed security settings, impacting millions of downloads.