20260803-thehackernews.com-f42fc | Perceptive Security

< Back to index

Hugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Code

Published:

3 August 2026 at 08:40:31

Alert date:

3 August 2026 at 10:02:36

Source:

thehackernews.com

Supply Chain & Dependencies, Emerging Technologies, Zero-Day Vulnerabilities

Three high-severity security vulnerabilities have been discovered in Hugging Face's Diffusers library, a widely used open-source tool for AI image generation models. The flaws allow crafted model repositories to execute arbitrary code on machines that load them, effectively bypassing the trust_remote_code safeguard designed to prevent unreviewed code from running. This represents a significant AI supply chain security risk, as users loading seemingly legitimate models could unknowingly execute malicious code. The vulnerabilities are particularly dangerous given the widespread adoption of Hugging Face's platform in the AI/ML community. The attack vector targets the model loading process, meaning developers and researchers downloading models are potentially at risk without obvious warning signs.

Technical details

Three high-severity vulnerabilities, collectively named 'FaceHugger', were discovered in Hugging Face's Diffusers Python library. The root cause is a Time-of-Check to Time-of-Use (TOCTOU) flaw where the 'trust_remote_code' security gate only runs during the first phase of a two-phase, non-atomic model download process (two sequential HTTP requests). This allows attackers to bypass the safeguard by injecting custom executable code that was not present during the trust check. CVE-2026-44827 (CVSS 8.8): Code injection via the custom_pipeline flow using a crafted pipeline named 'None.py', bypassing trust_remote_code=False. CVE-2026-45804 (CVSS 7.5): Race condition allowing arbitrary code injection by modifying repository configuration between the hf_hub_download and snapshot_download HTTP calls. CVE-2026-44513 (CVSS 8.8): Code injection through the custom_pipeline flow from a Hub repository despite trust_remote_code=False. Any user invoking 'DiffusionPipeline.from_pretrained' with custom pipelines is affected. The attack surface includes production pipelines, CI/CD systems, and container images embedding the library. The Diffusers package had over 8.1 million downloads in July 2026, indicating broad exposure.

Mitigation steps:

1. Upgrade Hugging Face Diffusers to version 0.38.0 or later, which contains patches for all three vulnerabilities. 2. If immediate patching is not possible, apply the following workarounds: a) Only call from_pretrained with pretrained_model_name_or_path, custom_pipeline, and local snapshot directories from fully trusted and audited sources. b) Do not pass custom_pipeline= pointing at a Hub repository different from the primary pretrained_model_name_or_path before manually reading its pipeline.py. c) Before calling from_pretrained on a local snapshot, inspect the snapshot for unexpected *.py files, especially under component subdirectories (unet/, scheduler/, etc.) and at the snapshot root. 3. Treat all AI model repositories as untrusted code sources. 4. Audit CI/CD pipelines, container images, and production systems that use the Diffusers library with custom pipelines.

Affected products:

Hugging Face Diffusers Python library (versions prior to 0.38.0)
DiffusionPipeline API (from_pretrained with custom pipelines)