Hugging Face Diffusers Flaws: Arbitrary Code Execution Risk

Three high-severity security flaws have been found in Hugging Face's Diffusers library. These flaws could allow specially made model repositories to run arbitrary code on machines that load them. This opens up the artificial intelligence supply chain to security risks. The vulnerabilities bypass "trust_remote_code," a safeguard meant to stop unreviewed code from running. Researchers named these shortcomings FaceHugger. Diffusers is a Python package for generating videos, images, and audio using pretrained diffusion models. It has been downloaded over 8.1 million times in July 2026. Because Hugging Face is widely used, vulnerabilities in libraries like Diffusers can give attackers broad access. This is due to how the library is embedded in production systems. The core issue stems from the "trust_remote_code" check happening too early in the loading process. This allows custom code to be seen by the loader without being checked. One vulnerability, CVE-2026-44827, has a CVSS score of 8.8. It allows code injection even when "trust_remote_code" is set to False. Another, CVE-2026-45804, with a CVSS score of 7.5, is a race condition that lets attackers inject code by modifying configurations during downloads. These findings highlight serious security concerns for anyone using AI models from Hugging Face.