- Three high-severity vulnerabilities, collectively named FaceHugger, were disclosed in Hugging Face’s Diffusers library, allowing arbitrary code execution on machines that load crafted model repositories.
- The flaws bypass the trust_remote_code safeguard, which is designed to prevent unreviewed code from running during custom pipeline loading.
- Attackers can exploit a Time-of-Check to Time-of-Use (TOCTOU) race condition due to the model download being split into two non-atomic HTTP requests.
- The vulnerabilities were patched in Diffusers version 0.38.0 (released May 2026), and users are advised to only load models from trusted, audited sources.
Three high-severity security flaws have been disclosed in Hugging Face’s Diffusers library, enabling crafted model repositories to stealthily execute arbitrary code on machines that load them. Zafran Labs researchers Gal Zaban and Ido Shani identified the vulnerabilities, collectively named FaceHugger, as bypassing the trust_remote_code safeguard designed to stop unreviewed code from running.
The root cause stems from a Time-of-Check to Time-of-Use (TOCTOU) flaw in the model download process, which uses two sequential, non-atomic HTTP requests. Consequently, an attacker can modify the repository configuration between the two requests to inject malicious code.
The three vulnerabilities include CVE-2026-44827 (CVSS 8.8), a code injection flaw allowing arbitrary code loading through a crafted pipeline named “None.py” despite trust_remote_code=False. CVE-2026-45804 (CVSS 7.5) is a race condition that introduces arbitrary code by altering the configuration between HTTP calls. CVE-2026-44513 (CVSS 8.8) similarly enables code injection through the custom_pipeline flow.
The issues were addressed in Diffusers version 0.38.0, released in early May 2026. “The underlying problem is that artifacts pulled from AI repositories are frequently treated as passive data,” the researchers added, noting that configuration files and custom pipeline code can quietly become executable code. Users are advised to only load models from fully trusted sources and inspect local snapshots for unexpected Python files.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
