Hugging Face Diffusers Flaws Allow Arbitrary Code Execution via Malicious Models
Three critical vulnerabilities in Hugging Face's Diffusers library, collectively named FaceHugger, enable attackers to execute arbitrary code by tricking users into loading specially crafted model repositories.
Three high-severity security flaws have been disclosed in Hugging Face's Diffusers library, a popular tool for AI model generation, that could allow crafted model repositories to stealthily execute arbitrary code on machines that load them. These vulnerabilities, collectively named FaceHugger, pose a significant risk to the artificial intelligence (AI) supply chain, a growing concern for enterprise environments.
Researchers at Zafran Labs identified that these flaws bypass the trust_remote_code safeguard, which is designed to prevent unreviewed custom code from running during the loading process of custom pipelines. "The root cause of all different RCE variants [...] is that the trust check lives entirely in the first phase," the researchers explained. This means that any method allowing the loader to encounter custom code that the security gate did not, can bypass the trust_remote_code mechanism.
Hugging Face has become a central hub for AI development, often referred to as the "GitHub of the AI era." Its libraries and repositories are widely used in production pipelines, CI/CD systems, and container images. Consequently, vulnerabilities in libraries like Diffusers can grant attackers extensive access, making the AI supply chain a prime target.
The Diffusers Python package, downloaded over 8.1 million times in July 2026, allows users to load state-of-the-art pretrained diffusion models for generating various media. A key feature is the ability to load models from Hugging Face hub repositories via the DiffusionPipeline API, which uses configuration files to initialize pipeline components and custom code. The trust_remote_code parameter is crucial here; setting it to True allows custom code execution, while False (or omitting it) blocks unverified code.
Each of the FaceHugger vulnerabilities stems from a Time-of-Check to Time-of-Use (TOCTOU) race condition. The model download process involves two sequential, non-atomic HTTP requests instead of a single atomic operation. The trust_remote_code security check is only performed against the first request, leaving an opening for manipulation.
The specific vulnerabilities include CVE-2026-44827 (CVSS 8.8), a code injection flaw allowing arbitrary code execution through the custom pipeline flow using a crafted pipeline named "None.py" even when trust_remote_code=False. CVE-2026-45804 (CVSS 7.5) is a race condition where attackers can modify the configuration between HTTP calls to the Hub, leading to code execution. Lastly, CVE-2026-44513 (CVSS 8.8) is another code injection vulnerability in the custom pipeline flow that bypasses the trust_remote_code setting.
These vulnerabilities were addressed in Diffusers version 0.38.0, released in early May 2026. Users who invoke DiffusionPipeline.from_pretrained with custom pipelines are impacted. As a workaround, Hugging Face recommends only using from_pretrained with trusted sources, avoiding pointing custom_pipeline to a different Hub repository than the primary model, and inspecting local snapshots for unexpected Python files before loading.
"These vulnerabilities underscore the critical need to treat AI model repositories as untrusted code," Zafran Labs stated. "A routine model download can easily become a vector for arbitrary code execution if security boundaries like trust_remote_code are bypassed." The findings highlight the inherent risks when AI artifacts are treated as passive data rather than potentially executable code.