Hugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Code

The Trust Gate That Wasn't

Hugging Face's trust_remote_code flag is meant to be a load-bearing safeguard: a developer explicitly opts in to allowing custom Python code from a model repository to run during the from_pretrained() call. When set to False — the default — the library is supposed to refuse to execute any unvetted code shipped alongside a model. According to Zafran Labs researchers Gal Zaban and Ido Shani, that gate has three holes in Diffusers, collectively tracked under the umbrella name FaceHugger. CVE-2026-44827 and CVE-2026-44513 (both CVSS 8.8) abuse the custom_pipeline loading flow, with the first specifically weaponizing a file named None.py to slip code past the check. CVE-2026-45804 (CVSS 7.5) is a race condition: an attacker can swap the contents of a repository between the initial hf_hub_download and the subsequent snapshot_download HTTP calls, swapping a benign configuration for one that points at hostile code.

A TOCTOU Problem at the Heart of the Loader

The root cause, the researchers explain, is that the trust check lives entirely in the first phase of a two-phase model fetch. Any method that makes the loader see custom code that the gate did not see allows bypassing trust_remote_code. In security terms, this is a classic Time-of-Check to Time-of-Use (TOCTOU) failure: the system validates a state, then acts on a different state moments later. Zafran argues the fix is to collapse the download into a single atomic operation so the trust check and the actual code load see the same repository contents. Until then, the only safe path is to treat the model-loading process as if it were executing arbitrary code on the developer's machine — because, in practice, it can.

The AI Supply Chain Is Now an Initial-Access Vector

The reason FaceHugger matters beyond a routine CVE cycle is the scale of the Diffusers footprint. The package was downloaded more than 8.1 million times in July 2026, and Hugging Face has become what the researchers describe as the "GitHub of the AI era." Diffusers in particular is embedded in production pipelines, CI/CD systems, and container images — exactly the environments where a single malicious artifact can pivot into credentials, secrets, and lateral movement. The workarounds Hugging Face's maintainers recommend amount to manual auditing: only load from trusted sources, inspect local snapshots for unexpected .py files under component directories like unet/ and scheduler/, and never pass custom_pipeline pointing at a repository that has not been read end-to-end. Patched Diffusers 0.38.0, released in early May 2026, addresses all three variants, but any deployment that hasn't upgraded — or that relies on older frozen container images — remains exposed to what Zafran calls a routine model load turning into an initial-access vector.