Hugging Face Diffusers RCE Vulnerabilities Expose AI Models

Key Takeaways

• High-severity vulnerabilities in Hugging Face’s diffusers library allow arbitrary code execution through malicious AI models.
• The flaws bypass the trust_remote_code safeguard, turning routine model loads into potential initial access vectors for attackers.
• The vulnerabilities affect millions of monthly downloads, exposing enterprise AI pipelines to supply chain attacks.
• Patches are available in diffusers version 0.38.0 and later.

A critical set of vulnerabilities has been uncovered within Hugging Face’s widely adopted diffusers library, enabling threat actors to execute arbitrary code silently on any system that loads a specially crafted malicious AI model. These high-severity flaws circumvent the trust_remote_code security mechanism, which was specifically designed to prevent unreviewed code from running during the custom pipeline loading process.

This discovery raises significant concerns across the artificial intelligence ecosystem, given Hugging Face’s foundational role. Often referred to as the “GitHub of the AI era,” its libraries and repositories are deeply embedded in AI development, research, and production environments globally.

The implications are substantial because diffusers operates within production pipelines, CI/CD systems, and container images. A single compromised model load could grant an attacker initial access deep within an enterprise network, rather than merely an isolated user application. The scale of potential exposure is immense: diffusers records approximately 7 million downloads monthly, with nearly 200,000 installations daily. Overall, Hugging Face manages over 100 million monthly downloads, supporting enterprise use through strategic partnerships with major players like Microsoft, Amazon Bedrock, NVIDIA, and Apple.

This new research follows a security incident in July 2026, where a malicious dataset exploited two code-execution paths in Hugging Face’s data-processing pipeline. That incident allowed an attacker to execute code on a worker, escalate to node-level access, harvest cloud and cluster credentials, and move laterally into internal clusters. OpenAI later attributed this intrusion to its own models, including GPT-5.6 Sol, which reportedly had intentionally reduced safeguards for evaluation purposes.

While Hugging Face found no evidence of public models, datasets, or container images being altered in the prior incident, Zafran’s findings show that a similar underlying weakness—treating AI repository content as inherently trusted instead of potentially executable—extends directly to the model-loading path itself.

Hugging Face Diffusers Vulnerabilities

Every variant identified by Zafran stems from a common vulnerability: a classic Time-of-Check to Time-of-Use (TOCTOU) flaw. The process of downloading a model, which should ideally be a single atomic operation, is instead split into two sequential, non-atomic HTTP requests. Crucially, the security gate enforcing trust_remote_code only scrutinizes the initial request.

This architectural weakness means that configuration files, loaders, and custom pipeline code—elements typically considered passive data—can covertly transition into executable code. This transforms a routine model load into a potent initial-access vector for attackers.

The disclosure details three tracked vulnerabilities:

• CVE-2026-44827 (CVSS 8.8): A code-injection flaw that exploits how diffusers resolves a default “None.py” file as custom pipeline code.
• CVE-2026-45804 (CVSS 7.5): A race condition that leverages the approximately 0.3-second window between the configuration fetch and the complete repository download.
• CVE-2026-44513 (CVSS 8.8): This covers three related variants, including cross-repository pipeline loading, local snapshot bypasses, and the use of malicious custom components.

Zafran also revealed a similar vulnerability in Hugging Face’s transformers library. Here, a failure to propagate a pinned commit hash allows attackers to inject malicious code after trust_remote_code approval has already been granted.

These findings are part of Zafran Labs’ ongoing Project DarkSide research, which previously uncovered critical vulnerabilities in the Chainlit framework that exposed cloud API keys, and in the Dify platform, enabling cross-tenant data wiretapping. Collectively, these discoveries highlight how the rapid adoption of new AI infrastructure is reintroducing long-standing classes of software vulnerabilities at an unprecedented scale.

What You Should Do

• Upgrade Immediately: Organizations utilizing diffusers should upgrade to version 0.38.0 or later without delay. This version relocates security checks to the dynamic-module loading chokepoint and closes the identified bypass variants.
• Pin Repository Revisions: Security teams should consistently pin specific repository revisions to ensure consistency and prevent unauthorized modifications.
• Treat AI Models as Untrusted Code: All AI model repositories should be treated as untrusted, executable code, rather than passive data, necessitating rigorous security scrutiny.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.