Ethical Hacking News
The recent discovery of three high-severity vulnerabilities in Hugging Face's Diffusers library has raised significant concerns about the security risks associated with AI model repositories and the broader AI supply chain. The vulnerabilities, collectively known as "FaceHugger," can allow crafted model repositories to execute arbitrary code on machines that load it, potentially compromising enterprise environments. To mitigate this risk, users are advised to follow recommended workarounds while awaiting patching. This critical threat highlights the need for enhanced security measures in AI development and deployment.
The recent disclosure of three high-severity security flaws in Hugging Face's Diffusers library has raised serious concerns about AI model repositories and the AI supply chain.The vulnerabilities, known as "FaceHugger," allow crafted model repositories to execute arbitrary code on machines that load it, potentially compromising enterprise environments.The vulnerabilities bypass trust_remote_code, a safeguard designed to stop unreviewed code from running in custom pipelines loading processes.The root cause of the vulnerability lies in how Diffusers works, specifically with its configuration file and custom pipeline code.Each variant of the vulnerability has been traced back to a design flaw where model download is done as two sequential HTTP requests instead of one atomic operation.The researchers have identified three vulnerabilities: CVE-2026-44827, CVE-2026-45804, and CVE-2026-44513, all of which can allow arbitrary code execution.The vulnerabilities were addressed in Diffusers version 0.38.0, but users who invoke "DiffusionPipeline.from_pretrained" with custom pipelines may need to wait for a patch.To mitigate the risk, the project maintainers have recommended several workarounds, including only using trusted sources and inspecting local snapshots for unexpected files.
The recent disclosure of three high-severity security flaws in Hugging Face's Diffusers library has sent shockwaves throughout the AI community, raising serious concerns about the potential risks associated with model repositories and the AI supply chain. The vulnerabilities, collectively known as "FaceHugger," can allow crafted model repositories to stealthily execute arbitrary code on machines that load it, potentially compromising the integrity of enterprise environments and granting attackers extensive access.
In an analysis published last week by Zafran Labs researchers Gal Zaban and Ido Shani, the researchers revealed that these vulnerabilities are bypassing trust_remote_code, a safeguard designed to stop unreviewed code from running in custom pipelines loading process. This critical security flaw has significant implications for organizations relying on Hugging Face's libraries and repositories in their enterprise environments.
To understand the root cause of this vulnerability, it is essential to delve into the details of how Diffusers works. The library serves as a repository of state-of-the-art pretrained diffusion models for generating videos, images, and audio. One of its key capabilities is to locally load a model from a Hugging Face hub repository via the DiffusionPipeline API. This process utilizes a configuration file to initialize specific pipeline and component classes, along with custom pipeline code.
The trust_remote_code parameter in Diffusers plays a pivotal role in controlling whether custom Python code hosted inside a model repository is allowed to execute during "from_pretrained()" loading. When set to True, this parameter permits custom code execution, while False or omitting it blocks unverified code from running. However, the researchers identified that the trust check lives entirely in the first phase, leaving room for bypassing the mechanism through a Time-of-Check to Time-of-Use (TOCTOU) attack.
Each variant of the vulnerability has been traced back to this very case. The model download is designed as two sequential, non-atomic HTTP requests instead of one single atomic operation. Moreover, the trust_remote_code security gate is configured to run only against the first request. This design flaw allows attackers to craft a pipeline with the name "None.py" that bypasses the safeguard despite setting trust_remote_code=False (or omitting it, which is the default).
The researchers have collectively named these vulnerabilities as FaceHugger. The three identified flaws are:
1. CVE-2026-44827: A code injection vulnerability allowing arbitrary code to be loaded through the custom_pipeline flow from a Hub repository by means of a crafted pipeline with the name "None.py" despite passing trust_remote_code=False (or omitting it, which is the default).
2. CVE-2026-45804: A race condition vulnerability that allows arbitrary code to be introduced into a repository by modifying the configuration between the hf_hub_download and snapshot_download HTTP calls to the Hub, leading to code execution.
3. CVE-2026-44513: Another code injection vulnerability allowing arbitrary code to be loaded through the custom_pipeline flow from a Hub repository despite passing trust_remote_code=False (or omitting it).
Following responsible disclosure, the vulnerabilities were addressed in Diffusers version 0.38.0, released in early May 2026. However, for users who invoke "DiffusionPipeline.from_pretrained" with custom pipelines, immediate patching may not be an option.
To mitigate this risk, the project maintainers have recommended several workarounds:
* Only call from_pretrained() with pretrained_model_name_or_path, custom_pipeline, and local snapshot directories from fully trusted sources that have been audited.
* Do not pass custom_pipeline pointing at a Hub repository different from the primary pretrained_model_name_or_path before reading its pipeline.py.
* Before calling from_pretrained on a local snapshot, inspect the snapshot for unexpected *.py files, especially under component subdirectories (unet/, scheduler/, etc.) and at the snapshot root.
These vulnerabilities underscore the critical need to treat AI model repositories as untrusted code, particularly as enterprise reliance on platforms like Hugging Face continues to grow. A routine model download can easily become a vector for arbitrary code execution if security boundaries like trust_remote_code are bypassed.
Related Information:
https://www.ethicalhackingnews.com/articles/Hugging-Face-Diffusers-Flaws-A-Critical-Threat-to-AI-Model-Repositories-and-the-AI-Supply-Chain-ehn.shtml
https://thehackernews.com/2026/08/hugging-face-diffusers-flaws-could-let.html
https://nvd.nist.gov/vuln/detail/CVE-2026-44827
https://www.cvedetails.com/cve/CVE-2026-44827/
https://nvd.nist.gov/vuln/detail/CVE-2026-45804
https://www.cvedetails.com/cve/CVE-2026-45804/
https://nvd.nist.gov/vuln/detail/CVE-2026-44513
https://www.cvedetails.com/cve/CVE-2026-44513/
Published: Mon Aug 3 03:09:59 2026 by llama3.2 3B Q4_K_M
