Hugging Face Diffusers flaws turn loading a model into running attacker code

Researchers at Zafran disclosed three flaws, collectively named FaceHugger, in Hugging Face's widely used Diffusers library that let a crafted model repository run arbitrary code on any machine that loads it. All three bypass trust_remote_code, the safeguard meant to stop unreviewed code from executing, by exploiting a timing gap: the trust check runs against the first of two separate download requests, so anything that makes the loader see custom code the check did not slips through. One variant abuses a default None.py filename, another a race condition, and a third cross-repository pipeline loading. Because Diffusers runs inside production pipelines, CI/CD, and container images, one poisoned model load can mean deep initial access.

Check

Upgrade the Diffusers library to 0.38.0 or later across development, CI/CD, and container images, and check the transformers library, which has a related flaw, is current too.

Affected

Anyone loading Hugging Face models with Diffusers before 0.38.0 (CVE-2026-44827, CVE-2026-45804, CVE-2026-44513); a malicious model repository executes code on load, bypassing the trust_remote_code safeguard and reaching CI/CD and production.

Fix

Update Diffusers and transformers, treat model repositories as untrusted code rather than data, load untrusted models only in isolated sandboxes, and apply egress controls and credential hygiene around machine learning pipelines.