Three high-severity flaws in Hugging Face’s Diffusers library could let crafted model repositories execute arbitrary code on machines that load them, bypassing the trust_remote_code safeguard meant to block unreviewed code. Researchers at Zafran Labs named the set FaceHugger.
The issues are CVE-2026-44827 and CVE-2026-44513, both code injection bugs scored 8.8, plus CVE-2026-45804, a race condition scored 7.5. All trace to a time-of-check to time-of-use gap: the model download runs as two sequential, non-atomic HTTP requests, and the trust gate only checks the first.
That lets an attacker swap in malicious code between the hf_hub_download and snapshot_download calls, or smuggle a pipeline named None.py past the gate. Anyone calling DiffusionPipeline.from_pretrained with custom pipelines is affected.
Diffusers, a Python library for generating images, video and audio, logged more than 8.1 million downloads in July 2026 alone. With Hugging Face increasingly described as the GitHub of AI, the package is baked into production pipelines, CI/CD systems and container images across enterprise environments, so a poisoned repository can reach deep into corporate estates.
The flaws were fixed in Diffusers 0.38.0, released in early May 2026. Zafran Labs says users should upgrade and treat model repositories as untrusted input.
