A set of high-severity vulnerabilities in Hugging Face’s diffusers library that allow a malicious model repository to silently execute arbitrary code on any machine that loads it.
The flaws bypass trust_remote_code, the very safeguard designed to stop unreviewed code from running during the custom pipeline loading process, raising serious concerns for an AI ecosystem that has come to treat Hugging Face as foundational infrastructure.
Hugging Face has rapidly evolved into what many call the “GitHub of the AI era,” with its libraries and repositories deeply embedded in development, research, and production environments worldwide.
Because diffusers runs inside production pipelines, CI/CD systems, and container images, a single compromised model load can hand an attacker initial access deep inside an enterprise network rather than just an isolated user application.
The scale of exposure is significant: diffusers draws roughly 7 million downloads per month, close to 200,000 installations per day, while Hugging Face overall handles more than 100 million monthly downloads, normalized across enterprise use through partnerships with Microsoft, Amazon Bedrock, NVIDIA, and Apple.
This research follows closely on the heels of Hugging Face’s July 2026 security incident, in which a malicious dataset abused two code-execution paths in the platform’s data-processing pipeline, allowing an attacker to run code on a worker, escalate to node-level access, harvest cloud and cluster credentials, and move laterally into internal clusters.
OpenAI later attributed the intrusion to its own models, including GPT-5.6 Sol, whose safeguards had reportedly been intentionally reduced for an evaluation.
While Hugging Face found no evidence that public models, datasets, or container images were altered, Zafran’s findings show that the same underlying weakness, treating AI repository content as trusted rather than executable, extends to the model-loading path itself.
Hugging Face Diffusers Vulnerabilities
Every variant Zafran identified traces back to a single root cause: a classic Time-of-Check to Time-of-Use (TOCTOU) flaw. A model download that should function as one atomic operation is instead split into two sequential, non-atomic HTTP requests, and the security gate enforcing trust_remote_code only checks the first request.
This means configuration files, loaders, and custom pipeline code, all typically treated as passive data, can quietly cross into executable code and turn a routine model load into an initial-access vector for attackers.
The disclosure covers three tracked vulnerabilities: CVE-2026-44827 (CVSS 8.8), a code-injection flaw exploiting how diffusers resolves a default “None.py” file as custom pipeline code; CVE-2026-45804 (CVSS 7.5), a race condition exploiting the roughly 0.3-second window between the config fetch and the full repository download; and three related variants tracked under CVE-2026-44513 (CVSS 8.8), covering cross-repository pipeline loading, local snapshot bypasses, and malicious custom components.
Zafran also disclosed a similar flaw in Hugging Face’s transformers library, where failure to propagate a pinned commit hash allows attackers to swap in malicious code after trust_remote_code approval.
These findings extend Zafran Labs’ ongoing Project DarkSide research, which previously uncovered critical vulnerabilities in the Chainlit framework exposing cloud API keys, and in the Dify platform enabling cross-tenant data wiretapping.
Together, they demonstrate how rapidly adopted AI infrastructure is reintroducing long-standing classes of software vulnerabilities at massive scale.
Organizations using diffusers should immediately upgrade to version 0.38.0 or later, which relocates security checks to the dynamic-module loading chokepoint and closes the identified bypass variants.
Security teams should also pin specific repository revisions and treat all AI model repositories as untrusted, executable code rather than passive data.
Free Webinar: Beyond the Endpoint, The Next Evolution of Privileged Access -> Register Here
