Three high-severity security flaws have been disclosed in Hugging Face’s Diffusers library that could allow crafted model repositories to stealthily execute arbitrary code on machines that load it, opening the artificial intelligence (AI) supply chain to security risk.
“These vulnerabilities are bypassing trust_remote_code, the safeguard designed to stop unreviewed code from running in the custom pipelines loading process,” Zafran Labs researchers Gal Zaban and Ido Shani said in an analysis published last week.
The shortcomings have been collectively named FaceHugger.
With Hugging Face becoming the “GitHub of the AI era” and its libraries and repositories prevalent in enterprise environments, vulnerabilities in libraries like Diffusers can grant attackers extensive access owing to how the library is embedded into production pipelines, CI/CD systems, and container images.
Diffusers is a Python package that serves as a library of state-of-the-art (SOTA) pretrained diffusion models for generating videos, images, and audio. According to statistics shared on pepy.tech, the package has been downloaded more than 8.1 million times in July 2026.
One of the key capabilities of the library is to locally load a model from a Hugging Face hub repository via the DiffusionPipeline API, which, in turn, makes use of a configuration file to initialize specific pipeline and component classes, along with custom pipeline code.
The “trust_remote_code” parameter in Diffusers is a security safeguard that controls whether custom Python code hosted inside a model repository is allowed to execute during “from_pretrained()” loading. Setting it to “True” permits custom code execution, while “False” or omitting it blocks unverified code from running.
“The root cause of all different RCE variants […] is that the trust check lives entirely in the first phase,” Zafran explained. “Therefore, any method that makes the loader see custom code that the gate did not, allows bypassing the trust_remote_code mechanism.”
Each variant has been traced back to a case of Time-of-Check to Time-of-Use (TOCTOU), with the model download designed as two sequential, non-atomic HTTP requests instead of one a “single atomic operation” and the “trust_remote_code” security gate configured to run only against the first.
The vulnerabilities are listed below –
- CVE-2026-44827 (CVSS score: 8.8) – A code injection vulnerability that allows arbitrary code to be loaded through the custom_pipeline flow from a Hub repository by means of a crafted pipeline with the name “None.py” despite passing trust_remote_code=False (or omitting it, which is the default).
- CVE-2026-45804 (CVSS score: 7.5) – A race condition vulnerability that allows arbitrary code to be introduced to a repository by modifying the configuration between the hf_hub_download and snapshot_download HTTP calls to the Hub, leading to code execution.
- CVE-2026-44513 (CVSS score: 8.8) – A code injection vulnerability that allows arbitrary code to be loaded through the custom_pipeline flow from a Hub repository despite passing trust_remote_code=False (or omitting it).
Following responsible disclosure, the vulnerabilities were addressed in Diffusers version 0.38.0, released in early May 2026. Any user who invokes “DiffusionPipeline.from_pretrained” with custom pipelines is impacted.
“The underlying problem is that artifacts pulled from AI repositories are frequently treated as passive data, when configuration files, loaders, and custom pipeline code can quietly cross into executable code and turn a routine model load into an initial-access vector,” the researchers added.
If immediate patching is not an option, the project maintainers have recommended the following workarounds –
- Only call from_pretrained with pretrained_model_name_or_path, custom_pipeline, and local snapshot directories from fully trusted sources that have been audited.
- Do not pass custom_pipeline= pointing at a Hub repository different from the primary pretrained_model_name_or_path before reading its pipeline.py.
- Before calling from_pretrained on a local snapshot, inspect the snapshot for unexpected *.py files, especially under component subdirectories (unet/, scheduler/, etc.) and at the snapshot root.
“These vulnerabilities underscore the critical need to treat AI model repositories as untrusted code, particularly as enterprise reliance on platforms like Hugging Face continues to grow,” Zafran said. “A routine model download can easily become a vector for arbitrary code execution if security boundaries like trust_remote_code are bypassed.”
