FaceHugger: Three Diffusers Flaws Let Malicious Hugging Face Repos Run Code on Model Load
❓What:
Zafran Labs researchers disclosed three flaws (collectively named FaceHugger) in Hugging Face's Diffusers library that bypass trust_remote_code, the safeguard meant to block unreviewed code from running during custom pipeline loading.
CVE-2026-44827 (CVSS 8.8) and CVE-2026-44513 (CVSS 8.8): code injection via the custom_pipeline flow that loads arbitrary code despite trust_remote_code=False or the parameter being omitted.
CVE-2026-45804 (CVSS 7.5): a race condition allowing an attacker to swap in malicious config between the hf_hub_download and snapshot_download calls.
Root cause: a TOCTOU flaw — the model download happens as two separate, non-atomic HTTP requests, but the trust check only runs against the first.
Diffusers has been downloaded over 8.1 million times in July 2026 alone; the flaws were patched in v0.38.0 (released early May 2026).
⚠️Impact:
Any environment invoking DiffusionPipeline.from_pretrained() with custom pipelines is exposed — a crafted model repo can achieve remote code execution the moment it's loaded.
High blast radius given Diffusers' presence in enterprise production pipelines, CI/CD systems, and container images.
Positions Hugging Face repos as a viable AI supply-chain initial-access vector — config files and pipeline code that look like passive data can silently become executable.
💡Recommendations:
Patch to Diffusers ≥0.38.0 immediately.
If patching is delayed: only call from_pretrained with model paths, custom_pipeline, and local snapshots from fully audited, trusted sources.
Never point custom_pipeline= at a Hub repo different from the primary model path without first reviewing its pipeline.py.
Before loading a local snapshot, inspect it for unexpected .py files, especially in component subdirectories (unet/, scheduler/) and at the snapshot root.
Treat all AI model repositories as untrusted code, not passive data, going forward.
Read the full story HERE