Critical Security Flaws in Hugging Face Diffusers
AI model repositories could allow arbitrary code execution
1Critical Vulnerabilities in Diffusers Library
Three high-severity security flaws were discovered in Hugging Face's Diffusers library. These vulnerabilities allow specially crafted model repositories to execute arbitrary code on machines loading the library without detection. Zafran Labs researchers state these flaws bypass the 'trust_remote_code' safeguard, risking the AI supply chain. The vulnerabilities have been collectively named FaceHugger.
2The GitHub of AI Under Threat
Hugging Face is referred to as 'the GitHub of the AI era' with its libraries widely used in enterprise environments. Vulnerabilities in libraries like Diffusers can provide attackers broad access as they're embedded in production pipelines, CI/CD systems, and container images. The library has been downloaded over 8.1 million times as of July 2026 and offers SOTA diffusion models for generating videos, images, and audio.
3How It Works
The Diffusers library uses a configuration file when loading models via DiffusionPipeline API from Hugging Face hub. The 'trust_remote_code' parameter controls whether custom Python code hosted in model repositories can execute. When set to 'True', custom code can run. However, the discovered vulnerabilities allow bypassing this security mechanism.
4TOCTOU Vulnerability
The root cause lies in security checks being performed entirely in the first phase. Zafran Labs explained all RCE variants stem from Time-of-Check to Time-of-Use (TOCTOU) flaws. The model download process is designed as two sequential HTTP requests with the 'trust_remote_code' security gate only checking the first request, making it bypassable.
5Patches and Workarounds
The vulnerabilities were fixed in Diffusers version 0.38.0 released in early May 2026 after responsible disclosure. All users employing custom pipelines with DiffusionPipeline.from_pretrained are affected. Project maintainers recommended temporary solutions for cases where immediate patching isn't possible. Researchers emphasize artifacts from AI repositories should be treated as untrusted code rather than passive data.
6Enterprise Risks
Zafran notes these vulnerabilities become critical as enterprise reliance on platforms like Hugging Face grows. Bypassing security boundaries like 'trust_remote_code' can turn routine model downloads into arbitrary code execution vectors. How organizations handle AI-driven open source risks, remediation debt, and governance at scale is becoming increasingly important.
7AI Security Paradigm
Researchers warn that configuration files, loaders, and custom pipeline code can silently transition into executable code. This can transform routine model loading into initial access vectors. Managing risk, securing AI-built software, and maintaining control becomes increasingly challenging as development progresses at machine speed.
8Wake-up Call for the Industry
This incident demonstrates how critical security flaws in the AI ecosystem can have severe consequences. Hugging Face's widespread use amplifies the impact. Organizations must treat AI model repositories as untrusted code and strengthen security boundaries. AI supply chain security will become one of the top cybersecurity priorities in the coming period.
Original article: The Hacker News — Hugging Face Diffusers'te Kritik Güvenlik Açıkları