FaceHugger: Diffusers Vulnerabilities Bypass the trust_remote_code Safeguard

Zafran Labs has reported three high-severity vulnerabilities in Hugging Face's Diffusers library. A specially crafted model repository can covertly execute arbitrary code on the machine that loads it — which puts the entire AI supply chain at risk. The set of issues has been given the collective name FaceHugger.

Diffusers is a Python library of pretrained diffusion models for generating images, video and audio. According to pepy.tech, the package was downloaded more than 8.1 million times in July 2026. Given that Hugging Face has become the “GitHub of the AI era” and is deeply embedded in production pipelines, CI/CD systems and container images, a vulnerability in such a library grants an attacker broad access.

Bypassing the main safeguard

The key trust_remote_code parameter is meant precisely to block the execution of unverified user code when from_pretrained() is called. It is disabled by default. However, as researchers Gal Zaban and Ido Shani explain, the trust check happens only at the first stage of loading. Any way of slipping the loader code that the “guard” never saw will bypass the protection.

At the heart of every variant is the classic TOCTOU (time-of-check to time-of-use) flaw: model downloading is set up not as a single atomic operation but as two sequential HTTP requests, while the check is performed only on the first of them.

Three vulnerabilities were identified:

• CVE-2026-44827 (CVSS 8.8) — code injection through the custom_pipeline flow using a crafted pipeline named None.py, which triggers even when trust_remote_code=False.
• CVE-2026-45804 (CVSS 7.5) — a race condition: the repository configuration is swapped out between the hf_hub_download and snapshot_download calls.
• CVE-2026-44513 (CVSS 8.8) — another code injection via custom_pipeline that bypasses trust_remote_code=False.

Everyone who calls DiffusionPipeline.from_pretrained with custom pipelines is affected.

What to do

Following responsible disclosure, the issues were fixed in Diffusers 0.38.0, released in early May 2026. If updating immediately isn't possible, the developers advise working only with fully trusted and vetted sources, not pointing custom_pipeline= at an outside repository without first reading its pipeline.py, and, before loading a local snapshot, scanning it for unexpected *.py files — especially in component subdirectories such as unet/ and scheduler/.

The researchers' main takeaway is simple: artifacts from AI repositories are often treated as passive data, whereas configuration files, loaders and custom pipeline code are easily turned into executable code. A routine model download thus becomes an initial-access vector, and model repositories should be regarded as inherently untrusted code.

Source: The Hacker News