Three flaws in Hugging Face's Diffusers library could let a malicious model repository run arbitrary code

Security researchers have disclosed three high-severity vulnerabilities in Hugging Face's Diffusers library, the widely used Python toolkit for running image and video generation models, that could allow a maliciously crafted model repository to execute arbitrary code on a victim's machine. The flaws, collectively named FaceHugger, defeat the library's built-in trust_remote_code safeguard — the exact mechanism meant to stop this class of attack.

A timing gap, not a broken lock

Diffusers' trust_remote_code setting is designed to prevent unreviewed, potentially malicious Python code bundled inside a model repository from executing automatically when a user loads that model. The FaceHugger vulnerabilities exploit a Time-of-Check to Time-of-Use (TOCTOU) flaw in how that safeguard is implemented: verification happens during the first of two sequential HTTP requests made when downloading a model, but the actual code doesn't run until later. An attacker who can modify the repository's contents in the window between those two requests can slip malicious code past the check entirely. As the researchers put it, any method that makes the loader see custom code the security gate never inspected defeats the protection.

Three distinct entry points

The disclosure covers three separate CVEs. CVE-2026-44827 (CVSS 8.8) enables code injection through a crafted pipeline file deceptively named “None.py” — a filename choice designed to be overlooked during manual review. CVE-2026-45804 (CVSS 7.5) exploits the race condition in the download sequence directly. CVE-2026-44513 (CVSS 8.8) achieves code injection through manipulation of custom pipeline flows. All three share the same underlying weakness: the gap between when Diffusers checks a repository's trustworthiness and when it actually uses that repository's code.

Why the scale here matters

Diffusers was downloaded more than 8.1 million times in July 2026 alone, and it sits inside a huge number of production AI pipelines, CI/CD systems, and containerized deployments that automatically pull and run models with minimal human review. Any code path that calls DiffusionPipeline.from_pretrained with a custom pipeline is potentially exposed. In an ecosystem where teams routinely pull models from public repositories as a matter of course, a flaw that bypasses the one safeguard specifically built to vet that code has outsized reach.

What to do about it

Hugging Face's fix shipped in Diffusers version 0.38.0, released in May 2026 — teams still running older versions should update immediately. Where immediate patching isn't feasible, the safest posture is to load models only from fully trusted, audited sources and to manually inspect local model snapshots for unexpected Python files, particularly ones with misleading or camouflaged filenames.

As reported by The Hacker News, the disclosure adds to a growing pattern this year of AI supply-chain research targeting the trust mechanisms that let developers safely pull and run third-party models — mechanisms that are only as strong as the timing assumptions baked into their implementation.