Three FaceHugger flaws exposed Diffusers model loaders to code execution
Hugging Face has fixed three high-severity vulnerabilities in its Diffusers Python library that could allow a crafted model repository to execute arbitrary code on a machine loading it. Zafran Labs collectively named the flaws FaceHugger and said they bypassed the trust_remote_code safeguard.
The issues are tracked as CVE-2026-44827 and CVE-2026-44513, both with CVSS scores of 8.8, and CVE-2026-45804, scored at 7.5. Hugging Face addressed them in Diffusers 0.38.0, released in early May 2026. Users invoking DiffusionPipeline.from_pretrained with custom pipelines are affected.
How the safeguard could be bypassed
Diffusers provides pretrained diffusion models for generating images, video and audio. Its DiffusionPipeline API can load a model locally from a Hugging Face Hub repository, using configuration data to initialize pipeline and component classes together with custom pipeline code.
The trust_remote_code parameter is intended to decide whether Python code stored in a model repository may run during from_pretrained() loading. Setting it to true permits custom code; setting it to false, or omitting it under the default behavior, should block unverified code.
Zafran Labs found that the trust check occurred entirely during the first loading phase. The download process used two sequential, non-atomic HTTP requests, so the code seen later could differ from the content inspected by the security gate. The researchers classified each route as a Time-of-Check to Time-of-Use, or TOCTOU, problem.
This risk also sits within a broader pattern of attacks on AI infrastructure: an OpenAI agent attack targeting Hugging Face demonstrated how trusted access around model platforms can become part of an attack path, while FaceHugger shows that apparently passive repository artifacts may themselves cross into executable code.
What each vulnerability enabled
CVE-2026-44827 allowed code injection through the custom_pipeline flow using a crafted pipeline named None.py, even when trust_remote_code was false or absent. CVE-2026-44513 likewise allowed arbitrary code to load from a Hub repository through the custom_pipeline path despite the safeguard.
CVE-2026-45804 was a race condition. An attacker could modify repository configuration between the hf_hub_download and snapshot_download calls, introducing arbitrary code before the later stage consumed the repository.
The scale of exposure matters because Diffusers is embedded in production pipelines, CI/CD systems and container images. Pepy.tech statistics cited by the researchers show more than 8.1 million package downloads in July 2026.
Patch and restrict model sources
Organizations should upgrade to Diffusers 0.38.0. Where immediate patching is impossible, maintainers recommend calling from_pretrained only with audited model paths, custom pipelines and local snapshot directories from fully trusted sources.
- Do not point custom_pipeline at a Hub repository different from the primary model path before reviewing its pipeline.py.
- Inspect local snapshots for unexpected Python files at the root and in component directories such as unet and scheduler.
- Treat configurations, loaders and custom pipeline code as executable supply-chain inputs rather than passive model data.
For businesses operating AI workloads, the practical implication is to place model repositories under the same review, version-control and deployment restrictions applied to third-party code, while prioritizing the patched Diffusers release.