{"id":2172,"date":"2026-08-03T08:25:44","date_gmt":"2026-08-03T08:25:44","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2172"},"modified":"2026-08-03T08:25:44","modified_gmt":"2026-08-03T08:25:44","slug":"hugging-face-diffusers-flaws-could-let-model-repositories-execute-arbitrary-code","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2172","title":{"rendered":"Hugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Code"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Aug 03, 2026<\/span><\/span>Vulnerability \/ AI Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Three high-severity security flaws have been disclosed in Hugging Face’s Diffusers<\/a> library that could allow crafted model repositories to stealthily execute arbitrary code on machines that load it, opening the artificial intelligence (AI) supply chain to security risk.<\/p>\n

\u00abThese vulnerabilities are bypassing trust_remote_code, the safeguard designed to stop unreviewed code from running in the custom pipelines loading process,\u00bb Zafran Labs researchers Gal Zaban and Ido Shani said<\/a> in an analysis published last week.<\/p>\n

The shortcomings have been collectively named FaceHugger<\/strong>.<\/p>\n

With Hugging Face becoming the \u00abGitHub of the AI era\u00bb and its libraries and repositories prevalent in enterprise environments, vulnerabilities in libraries like Diffusers can grant attackers extensive access owing to how the library is embedded into production pipelines, CI\/CD systems, and container images.<\/p>\n

Diffusers is a Python package<\/a> that serves as a library of state-of-the-art (SOTA) pretrained diffusion models for generating videos, images, and audio. According to statistics shared on pepy.tech, the package has been downloaded<\/a> more than 8.1 million times in July 2026.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

One of the key capabilities of the library is to locally load a model from a Hugging Face hub repository via the DiffusionPipeline<\/a> API, which, in turn, makes use of a configuration file to initialize specific pipeline and component classes, along with custom pipeline code.<\/p>\n

<\/p>\n

The \u00abtrust_remote_code\u00bb parameter in Diffusers is a security safeguard that controls whether custom Python code hosted inside a model repository is allowed to execute during \u00abfrom_pretrained()\u00bb loading. Setting it to \u00abTrue\u00bb permits custom code execution, while \u00abFalse\u00bb or omitting it blocks unverified code from running.<\/p>\n

\u00abThe root cause of all different RCE variants […] is that the trust check lives entirely in the first phase,\u00bb Zafran explained. \u00abTherefore, any method that makes the loader see custom code that the gate did not, allows bypassing the trust_remote_code mechanism.\u00bb<\/p>\n

\"\"<\/a><\/div>\n

Each variant has been traced back to a case of Time-of-Check to Time-of-Use (TOCTOU), with the model download designed as two sequential, non-atomic HTTP requests instead of one a \u00absingle atomic operation\u00bb and the \u00abtrust_remote_code\u00bb security gate configured to run only against the first.<\/p>\n

The vulnerabilities are listed below –<\/p>\n