According to statistics shared on pepy.tech, the Diffusers package was downloaded more than 8.1 million times in July 2026 — a scale that helps explain why three high‑severity vulnerabilities in that library have attracted immediate attention.
FaceHugger: three flaws uncovered in Hugging Face Diffusers
Researchers at Zafran Labs — Gal Zaban and Ido Shani — disclosed a set of shortcomings they named "FaceHugger" that affect the Diffusers Python library. Diffusers is a library of state‑of‑the‑art pretrained diffusion models used to generate images, video and audio, and it includes an API, DiffusionPipeline, that can locally load models from repositories on the Hugging Face Hub.
"These vulnerabilities are bypassing trust_remote_code, the safeguard designed to stop unreviewed code from running in the custom pipelines loading process," Zaban and Shani wrote in their analysis. They warned that the flaws allow crafted model repositories to stealthily execute arbitrary code on machines that load them, opening the AI supply chain to risk.
How trust_remote_code was bypassed: a TOCTOU weakness
The researchers traced each attack variant to a Time‑of‑Check to Time‑of‑Use (TOCTOU) problem. In practice, the model download was implemented as two sequential, non‑atomic HTTP requests instead of a single atomic operation, and the "trust_remote_code" gate ran only against the first request. As Zafran summarized: "The root cause of all different RCE variants [...] is that the trust check lives entirely in the first phase."
The two HTTP calls named in the disclosure are hf_hub_download and snapshot_download; by modifying what the loader actually reads between those calls, an attacker could cause untrusted or unexpected code to be introduced and later executed during model initialization.
Built by Nubivance.
OSINTSights' secure edge-first architecture, AI content pipeline, and serverless ops are designed by Nubivance. We do this for clients too.
Talk to us →The CVEs, scores, and what can be executed
Zafran Labs and the advisory list three tracked vulnerabilities and their Common Vulnerability Scoring System (CVSS) values:
- CVE‑2026‑44827 (CVSS score: 8.8) — a code injection vulnerability that allows arbitrary code to be loaded through the custom_pipeline flow from a Hub repository by means of a crafted pipeline with the name "None.py" despite passing trust_remote_code=False (or omitting it, which is the default).
- CVE‑2026‑45804 (CVSS score: 7.5) — a race condition vulnerability that allows arbitrary code to be introduced to a repository by modifying the configuration between the hf_hub_download and snapshot_download HTTP calls to the Hub, leading to code execution.
- CVE‑2026‑44513 (CVSS score: 8.8) — a code injection vulnerability that allows arbitrary code to be loaded through the custom_pipeline flow from a Hub repository despite passing trust_remote_code=False (or omitting it).
The disclosure notes that any user who invokes DiffusionPipeline.from_pretrained with custom pipelines is impacted. The risk is amplified because Diffusers is commonly embedded into production pipelines, CI/CD systems, and container images — contexts where a routine model load can become an initial‑access vector.
Patch, mitigations, and recommended workarounds
Following responsible disclosure, the vulnerabilities were addressed in Diffusers version 0.38.0, released in early May 2026. For organizations or users that cannot immediately upgrade, project maintainers recommended specific workarounds:
- Only call from_pretrained with pretrained_model_name_or_path, custom_pipeline, and local snapshot directories from fully trusted sources that have been audited.
- Do not pass custom_pipeline= pointing at a Hub repository different from the primary pretrained_model_name_or_path before reading its pipeline.py.
- Before calling from_pretrained on a local snapshot, inspect the snapshot for unexpected *.py files, especially under component subdirectories (unet/, scheduler/, etc.) and at the snapshot root.
The researchers emphasized the broader policy lesson: "The underlying problem is that artifacts pulled from AI repositories are frequently treated as passive data, when configuration files, loaders, and custom pipeline code can quietly cross into executable code and turn a routine model load into an initial‑access vector," Zafran said.
What this means for technologists, affected enterprises, and project maintainers
Technologists and security teams should treat model loads as potential attack surfaces: if you use DiffusionPipeline.from_pretrained with custom pipelines, upgrade to Diffusers 0.38.0 or apply the recommended inspections and restrictions before loading snapshots.
Affected enterprises and procurement leaders — particularly those that have integrated Hugging Face repositories into CI/CD, container images, or production pipelines — must recognize the operational exposure implied by more than 8.1 million downloads in a single month and the possibility that a model download becomes a vector for arbitrary code execution.
Project maintainers and maintainers of downstream images and pipelines should examine their use of trust_remote_code and the atomicity of download and verification steps; the disclosed TOCTOU pattern is the mechanism by which the gate was bypassed.
The FaceHugger disclosure is a pointed reminder that code and configuration embedded in AI model repositories can be active threats, not passive assets. For those relying on the Diffusers library, the immediate decisions are concrete: install the patch released in early May 2026, or follow the inspection and sourcing workarounds until you can. How quickly organizations treat model artifacts as untrusted code will determine whether a routine model load remains a benign operation or becomes the start of a compromise.
