CVE-2026-44827: Hugging Face Diffusers RCE Bypasses Trust Gate

Overview

Three high-severity vulnerabilities, collectively dubbed FaceHugger, have been disclosed in Hugging Face’s widely used Diffusers library. Discovered by Zafran Labs researchers Gal Zaban and Ido Shani, the flaws allow adversarially crafted model repositories to silently execute arbitrary code on any machine that loads them — even when the library’s primary security control, trust_remote_code=False, is explicitly set or left at its default. The library recorded over 8.1 million downloads in July 2026, making the blast radius of these vulnerabilities exceptionally broad.

Technical Analysis

Diffusers loads models from the Hugging Face Hub in two sequential, non-atomic HTTP phases: a configuration check (hf_hub_download) followed by a full snapshot pull (snapshot_download). The trust_remote_code security gate only runs against artefacts retrieved in the first phase. This creates a classic Time-of-Check to Time-of-Use (TOCTOU) window that all three CVEs exploit in slightly different ways:

CVE-2026-44827 (CVSS 8.8): A code injection flaw in the custom_pipeline flow. A repository can include a pipeline file named None.py that bypasses the trust check entirely and gets executed regardless of the trust_remote_code setting.
CVE-2026-45804 (CVSS 7.5): A race condition that allows an attacker to modify a repository’s configuration between the two HTTP calls. The malicious payload is invisible during the trust check but present when the snapshot is loaded.
CVE-2026-44513 (CVSS 8.8): A second code injection path through the custom_pipeline flow that bypasses trust_remote_code=False without relying on the None.py naming trick, suggesting the underlying gate logic has multiple blind spots.

The root cause, as Zafran summarised: “any method that makes the loader see custom code that the gate did not, allows bypassing the trust_remote_code mechanism.”

# Apparently safe call — but vulnerable to FaceHugger
pipe = DiffusionPipeline.from_pretrained(
    "malicious-org/crafted-model",
    trust_remote_code=False  # Bypassed by all three CVEs
)

Framework Mapping

Framework	Mapping	Rationale
MITRE ATLAS	AML.T0010 – ML Supply Chain Compromise	Malicious model repos weaponise the standard distribution channel
MITRE ATLAS	AML.T0018 – Backdoor ML Model	Crafted pipelines embed covert execution logic
OWASP LLM	LLM05 – Supply Chain Vulnerabilities	Trust boundary failure in third-party model loading
OWASP LLM	LLM07 – Insecure Plugin Design	Custom pipeline mechanism lacks atomic integrity validation

Impact Assessment

The affected population includes any engineer, data scientist, or automated pipeline calling DiffusionPipeline.from_pretrained() against a Hub-hosted model. Enterprise CI/CD systems that auto-pull updated model versions are particularly at risk because the race condition in CVE-2026-45804 can be triggered without any user interaction. Container images baked with Diffusers and pre-loaded models may also carry dormant payloads. Given Hugging Face’s status as the dominant model distribution platform, a single malicious repository targeting popular model names could compromise thousands of downstream environments.

Mitigation & Recommendations

Upgrade immediately — Apply the Hugging Face Diffusers patch addressing all three CVEs as soon as it is available.
Pin model revisions — Reference specific commit SHAs in from_pretrained() calls rather than floating main branch pointers.
Restrict hub access — Limit outbound network access from model-loading jobs to pre-approved repository lists.
Audit custom pipeline usage — Search codebases for custom_pipeline arguments and validate all referenced repositories.
Enable model scanning — Integrate static analysis tooling (e.g., ModelScan) into CI pipelines before model artefacts are consumed.

References

The Hacker News — Hugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Code