Three high‑severity vulnerabilities have been disclosed in Hugging Face’s Diffusers library that allow crafted model repositories to execute arbitrary code on machines that load them, bypassing the trust_remote_code safeguard. Researchers at Zafran Labs named the flaws “FaceHugger,” warning that Diffusers’ widespread use across enterprise AI pipelines, CI/CD systems, and container images makes the impact especially serious.
Diffusers is a Python library containing state‑of‑the‑art diffusion models for generating images, video, and audio. It has been downloaded more than eight million times in July 2026 alone. One of its core features is the ability to load models directly from Hugging Face repositories using DiffusionPipeline, which relies on configuration files and optional custom pipeline code. The trust_remote_code parameter is intended to block unverified Python code, but researchers found multiple ways to bypass it.
All three vulnerabilities stem from Time‑of‑Check to Time‑of‑Use issues caused by Diffusers downloading model artifacts through two separate HTTP requests. Because the trust check only applies to the first request, attackers can introduce malicious code during the second. The flaws include two code‑injection vulnerabilities (CVE‑2026‑44827 and CVE‑2026‑44513) and a race‑condition vulnerability (CVE‑2026‑45804) that allows configuration tampering between download phases.
The issues were patched in Diffusers version 0.38.0. Researchers stressed that AI model repositories must be treated as untrusted code, noting that routine model downloads can become initial‑access vectors if safeguards like trust_remote_code are bypassed.
