Hugging Face Diffusers Flaws Allow Arbitrary Code Execution via Malicious Model Repositories

Three high-severity vulnerabilities have been disclosed in Hugging Face’s Diffusers library, a popular Python package for generating images, videos, and audio using diffusion models. The flaws, collectively named FaceHugger, could allow crafted model repositories to execute arbitrary code on machines that load them, bypassing the trust_remote_code safeguard designed to prevent unreviewed code from running.

Researchers from Zafran Labs, Gal Zaban and Ido Shani, identified that the root cause of all variants is a Time-of-Check to Time-of-Use (TOCTOU) issue. The model download process is split into two sequential, non-atomic HTTP requests, and the trust_remote_code gate only checks the first request. Attackers can exploit this by modifying the repository between the two requests, allowing malicious code to be loaded despite the security setting.

The vulnerabilities are:

• CVE-2026-44827 (CVSS 8.8) – Code injection via a crafted pipeline named “None.py” in the custom_pipeline flow, bypassing trust_remote_code=False.
• CVE-2026-45804 (CVSS 7.5) – Race condition allowing arbitrary code introduction by modifying configuration between hf_hub_download and snapshot_download calls.
• CVE-2026-44513 (CVSS 8.8) – Code injection in the custom_pipeline flow, also bypassing trust_remote_code=False.

These issues were responsibly disclosed and patched in Diffusers version 0.38.0, released in early May 2026. Users who invoke DiffusionPipeline.from_pretrained with custom pipelines are affected. If immediate patching is not possible, maintainers recommend only loading models from fully trusted and audited sources, and inspecting local snapshots for unexpected .py files.

The researchers emphasize that AI model repositories should be treated as untrusted code, as configuration files and custom pipeline code can turn a routine model load into an initial-access vector. This is particularly critical as platforms like Hugging Face become integral to enterprise environments.