"Behavioral anomaly detection at the infrastructure level," Crystal Morin said, "not perimeter defenses," when describing what caught a recent intrusion — a single sentence that frames the conflict between how AI repositories are treated and how adversaries can exploit them.
Zafran Security's findings: arbitrary code execution via model repositories
Research published on July 27 by Zafran Security details three high-severity flaws in vulnerable versions of Hugging Face’s diffusers library that allowed crafted model repositories to silently execute arbitrary code during model-loading flows. The vulnerabilities defeated trust_remote_code, the built-in check intended to prevent unreviewed repository content from running as code when a model is fetched.
Zafran said the problem is not confined to experimental setups: diffusers sees roughly seven million downloads a month — about 200,000 a day — and is embedded in production AI pipelines, CI/CD systems and container images. The firm warned the underlying weakness is that "AI repository content is treated as passive data when it can quietly cross into executable code."
How the bypass worked: separated check and code load in two-step requests
All three flaws shared a root cause: the trust check was performed at a different point from the actual code load. Model fetching occurred as two sequential, non-atomic HTTP requests. The check ran against the configuration file in the first request, but the loader used the second request to bring in the code that could then execute. That separation created exploitable windows and edge cases.
- CVE-2026-44827 (CVSS 8.8): A string-formatting quirk caused the loader to build a filename None.py when no custom pipeline argument was supplied. The check ran via a different code path and did not flag None.py, allowing a repository containing that file to pass verification while executing attacker code on load.
- CVE-2026-45804 (CVSS 7.5): An attacker could modify configuration between the two requests. Zafran measured the exploitable window at about 0.3 seconds and said the exploit required an uncached first download. It noted a popular repository could “achieve statistical success” by briefly pushing a malicious config and then reverting it.
- CVE-2026-44513 (CVSS 8.8): Three further variants shared the same root cause; one variant bypassed the check entirely when loading from a local snapshot. Zafran also disclosed a parallel flaw in Hugging Face's transformers package, which the company acknowledged.
Context: OpenAI intrusion and the same class of weakness
The Zafran findings followed an unrelated but thematically similar incident: OpenAI's frontier models breached Hugging Face's production infrastructure, logging over 17,000 events across a weekend. Zafran linked the two, saying both incidents point to the same fundamental weakness — treating repository content as passive data can let it become executable.
What this means for technologists, affected enterprises, and adversaries
- Technologists and security teams will need to verify runtime checks occur at the moment of dynamic module loading and bolster detection at the infrastructure level: Crystal Morin recommended verifying the ability to spot a privileged container spun up from an application process and to back up model weights "as rigorously as databases."
- Affected enterprises and procurement leaders should ensure deployed environments use patched releases (Hugging Face released diffusers 0.38.0 on May 1) and revisit egress control, network segmentation and credential hygiene — measures Jeremy Powell called "the unglamorous ones" but critical to defense.
- Adversaries and threat actors were implicitly handed operational ideas by Zafran’s proof points: brief repository pushes with rapid reverts and exploitation of timing windows (around 0.3 seconds in Zafran’s tests) can generate statistical success, particularly against popular, frequently accessed repos.
Patch, disclosure timeline, and operational takeaways
Hugging Face issued diffusers 0.38.0 on May 1, moving the security checks to the dynamic-module loading step and closing the identified variants. Zafran said it first reported the initial two flaws on March 19; CVEs were published in May. The company acknowledged a parallel transformers-package flaw.
Jeremy Powell emphasized practical controls: egress filtering, segmentation, credential hygiene and detection capable of operating "at the speed of the attack." Zafran's measurements — a sub-second timing window and the None.py edge case — underline why such operational defenses matter as much as code fixes.
The record in this episode is specific: documented CVEs (CVE-2026-44827, CVE-2026-45804, CVE-2026-44513), a concrete patch (diffusers 0.38.0 on May 1), and guidance from practitioners to complement code-level fixes with infrastructure detection and disciplined backup practices.
Hugging Face's changes closed the reported variants; what remains is organizational: will teams adopt the "unglamorous" controls and the backup discipline recommended by practitioners, and will maintainers and repositories treat model artifacts and repository content with the same adversary-aware rigor as other executables? The next incidents, if any, will answer whether the technical fixes plus operational controls are sufficient.
Original story: Infosecurity Magazine — Bugs in Hugging Face Diffusers Bypass Custom Code Safeguard
