Hugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Code
Summary: Zafran Labs researchers Gal Zaban and Ido Shani disclosed three high-severity flaws in Hugging Face's Diffusers library, collectively named FaceHugger, that bypass the trust_remote_code safeguard and let crafted model repositories execute arbitrary code when loaded. The root cause is a Time-of-Check to Time-of-Use gap: the model download is two sequential, non-atomic HTTP requests while the trust check runs only against the first, and the flaws were fixed in Diffusers version 0.38.0, released in early May 2026.
Why it matters: Diffusers was downloaded more than 8.1 million times in July 2026 and is embedded in production pipelines, CI/CD systems, and container images, so a routine model load can become an initial-access vector. Anyone invoking DiffusionPipeline.from_pretrained with custom pipelines is affected, and the researchers' point is that AI repository artifacts are treated as passive data when configuration files and loaders can cross into executable code.
Read the original at The Hacker News ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026