Security researchers have identified three major vulnerabilities in the Hugging Face Diffusers library, posing a significant risk to the AI supply chain. Discovered by Zafran Labs, these flaws could enable malicious actors to run arbitrary code on systems utilizing the library, bypassing the ‘trust_remote_code’ security measure meant to prevent the execution of unreviewed code.
Understanding the FaceHugger Vulnerabilities
Researchers Gal Zaban and Ido Shani from Zafran Labs have dubbed these vulnerabilities ‘FaceHugger.’ Hugging Face, often compared to a GitHub for AI, relies heavily on libraries such as Diffusers in enterprise environments, making these vulnerabilities particularly concerning. The Diffusers library, a popular Python package for state-of-the-art diffusion models, has seen over 8.1 million downloads in July 2026 alone, highlighting its widespread use.
The key feature of this library, the DiffusionPipeline API, allows models to be loaded from Hugging Face hub repositories, utilizing configuration files to set up necessary components. The ‘trust_remote_code’ parameter is crucial here, as it determines whether custom Python code from a model repository is executed during the ‘from_pretrained()’ process. However, the vulnerabilities exploit a Time-of-Check to Time-of-Use (TOCTOU) flaw in this security mechanism.
Technical Breakdown of the Vulnerabilities
The FaceHugger vulnerabilities are categorized under three major CVE identifiers. CVE-2026-44827 involves a code injection issue, allowing arbitrary code execution through custom pipelines. This occurs even when ‘trust_remote_code’ is set to False. CVE-2026-45804 presents a race condition vulnerability, introducing arbitrary code by altering configurations between HTTP calls. Lastly, CVE-2026-44513 is another code injection flaw similar to the first but triggered under slightly different conditions.
These vulnerabilities arise from the model download process, which uses two separate HTTP requests instead of a single atomic operation, allowing gaps for exploitation. The ‘trust_remote_code’ gate, only active in the initial phase, fails to prevent these exploits effectively.
Mitigation and Future Outlook
The vulnerabilities were addressed with the release of Diffusers version 0.38.0 in early May 2026. However, users employing ‘DiffusionPipeline.from_pretrained’ with custom pipelines remain at risk. Zafran Labs advises users to only utilize fully audited and trusted sources for model paths and to scrutinize local snapshots for unexpected Python files before executing them.
These incidents emphasize the necessity of regarding AI model repositories as potentially unsafe code, especially as platforms like Hugging Face become integral to enterprise operations. Adhering to these safety recommendations is crucial in preventing potential breaches through routine model downloads.
