Hugging Face Diffusers Flaws Bypass Security Safeguards to Allow Arbitrary Code Execution

Three high-severity security vulnerabilities in the Hugging Face 'diffusers' library allow malicious model repositories to execute arbitrary code on any machine that loads them. These flaws are critical because they bypass the primary safety mechanism designed to prevent such attacks.

Identified by Zafran Labs as part of a research project dubbed 'FaceHugger,' the vulnerabilities enable arbitrary code execution (ACE) when a user loads a specially crafted model repository. Three specific CVEs have been documented: CVE-2026-44827 and CVE-2026-44513, both carrying a CVSS score of 8.8, and CVE-2026-45804, which has a CVSS score of 7.5.

The Failure of 'trust_remote_code'

The 'diffusers' library is a fundamental component of the AI ecosystem, used extensively to run diffusion models for generative imagery. Because these models are frequently shared via the Hugging Face Hub, users often pull repositories from various third-party contributors. To mitigate the risk of executing untrusted scripts, Hugging Face implemented the 'trust_remote_code' parameter. This safeguard requires users to explicitly opt-in before any custom code from a repository is allowed to run during the loading process.

However, these vulnerabilities render this control ineffective. By bypassing the 'trust_remote_code' check, the flaws allow unreviewed and potentially malicious code to execute even if the user has not granted permission or believes they have disabled remote code execution.

AI Supply Chain Implications

This discovery highlights a significant risk within the AI supply chain. Many enterprise AI pipelines are designed to automatically pull models or rely on community-shared weights to maintain efficiency. In such environments, an attacker could distribute a 'poisoned' model repository that appears legitimate but contains hidden malicious payloads.

Once the model is loaded, the arbitrary code execution could allow an attacker to steal sensitive credentials, install malware, or pivot deeper into a corporate network. Because the bypass occurs at the library level, traditional user-side precautions regarding remote code execution are insufficient to stop the attack.

What to Watch

Users of the 'diffusers' library should prioritize updating to patched versions to close these security gaps. As the AI community continues to rely on open-source hubs for model distribution, the industry must watch for further vulnerabilities that undermine the trust-based safeguards of model-loading frameworks. The 'FaceHugger' project underscores the necessity for more robust, automated scanning of model repositories before they are integrated into production environments.