Full Report
Three high-severity security flaws have been disclosed in Hugging Face's Diffusers library that could allow crafted model repositories to stealthily execute arbitrary code on machines that load it, opening the artificial intelligence (AI) supply chain to security risk. "These vulnerabilities are bypassing trust_remote_code, the safeguard designed to stop unreviewed code from running in the
Analysis Summary
# Vulnerability: FaceHugger - Hugging Face Diffusers RCE Bypasses
## CVE Details
- **CVE ID:** CVE-2026-44827, CVE-2026-45804, CVE-2026-44513
- **CVSS Score:** 8.8 (High) for 44827/44513; 7.5 (High) for 45804
- **CWE:** CWE-367 (Time-of-Check to Time-of-Use / Race Condition), CWE-94 (Code Injection)
## Affected Systems
- **Products:** Hugging Face `diffusers` library
- **Versions:** All versions prior to 0.38.0
- **Configurations:** Systems utilizing the `DiffusionPipeline.from_pretrained` API to load models, specifically when handling custom pipelines or remote code.
## Vulnerability Description
Researchers at Zafran Labs identified three flaws (collectively named **FaceHugger**) that allow an attacker to bypass the `trust_remote_code=False` security safeguard.
The root cause is a Time-of-Check to Time-of-Use (TOCTOU) vulnerability. The library performs the security check (validation of the repository) in an initial phase, but then executes a second, non-atomic HTTP request to download and execute the code. This gap allows a crafted repository to serve "safe" configuration files during the check and "malicious" code during the execution phase, or use specific naming conventions (like `None.py`) to slip past the security gate.
## Exploitation
- **Status:** PoC available (disclosed by researchers)
- **Complexity:** Medium (requires crafting a malicious Hub repository or winning a race condition)
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Arbitrary code execution allows full data access)
- **Integrity:** High (Attackers can modify models, data, or system files)
- **Availability:** High (Potential for system takeover or DoS)
## Remediation
### Patches
- **Upgrade to Diffusers version 0.38.0 or later.** This version addresses the non-atomic loading process to ensure security checks apply to all downloaded artifacts.
### Workarounds
- Only use `from_pretrained` with trusted, audited local snapshot directories or fully verified Hub repositories.
- Do not use the `custom_pipeline` argument pointing to untrusted Hub repositories.
- Manually inspect `pipeline.py` and configuration files before loading models from the Hub.
## Detection
- **Indicators of Compromise:** Unusual outbound connections from AI training or inference servers; presence of unexpected `.py` files (e.g., `None.py`) in local model caches.
- **Detection Methods:** Monitor CI/CD logs and container environments for unauthorized execution of Python processes during model loading stages. Audit Hugging Face Hub cache directories for suspicious scripts.
## References
- hxxps[://]thehackernews[.]com/2026/08/hugging-face-diffusers-flaws-could-let[.]html
- hxxps[://]github[.]com/advisories/GHSA-j7w6-vpvq-j3gm
- hxxps[://]github[.]com/advisories/GHSA-7wx4-6vff-v64p
- hxxps[://]github[.]com/advisories/GHSA-98h9-4798-4q5v
- hxxps[://]pypi[.]org/project/diffusers/