Bugs in Hugging Face Diffusers Bypass Custom Code Safeguard
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-44513 +1 in the same advisory: …44827 | Diffusers is the a library for pretrained diffusion models. Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, a trust_remote_code bypass in DiffusionPipeline.from_pretrained allows arbitrary remote code execution despite the user passing trust_remote_code=False (or omitting it, which is the default). The vulnerability has three variants, all sharing the same root cause — the trust_remote_code gate was implemented inside DiffusionPipeline.download() rather than at the actual dynamic-module load site, so any code path that bypassed or short-circuited download() also bypassed the security check. DiffusionPipeline.from_pretrained('repoA', custom_pipeline='attacker/repoB', trust_remote_code=False) — the gate evaluated against repoA's file list rather than repoB's, so repoB's pipeline.py was loaded and executed. DiffusionPipeline.from_pretrained('/local/snapshot', custom_pipeline='attacker/repoB', trust_remote_code=False) — the local-path branch never invoked download(), so the gate was never reached and remote code from repoB executed. DiffusionPipeline.from_pretrained('/local/snapshot', trust_remote_code=False) where the snapshot contains custom component files (e.g. unet/my_unet_model.py) referenced from model_index.json — same root cause; the local path skipped download() and custom component code executed. This vulnerability is fixed in 0.38.0. NVD description · AI analysis pending | 8.8 | 1% | PoC |
| — | |
| CVE-2026-45804 | Diffusers is the a library for pretrained diffusion models. Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers' DiffusionPipeline.from_pretrained flow can bypass the trust_remote_code guard because download() validates model_index.json and custom pipeline code before later loading from a cached folder that can change, allowing a Hub repository with custom .py pipeline code to execute through the custom pipeline flow without passing custom_pipeline or trust_remote_code=True. This issue is fixed in version 0.38.0. NVD description · AI analysis pending | 7.5 | <1% | PoC ×2 |
| — |
Full article511 words · extracted from infosecurity-magazine.com · click to collapse
Three high-severity flaws in vulnerable versions of Hugging Face’s diffusers library let crafted model repositories silently execute arbitrary code during affected loading flows, bypassing the safeguard built to prevent exactly that.
According to research from threat exposure management firm Zafran Security published on July 27, the flaws defeated trust_remote_code, the check meant to stop unreviewed code running when a model is fetched.
The library draws roughly seven million downloads a month, close to 200,000 a day, sitting inside production AI pipelines, CI/CD systems and container images.
The findings land days after OpenAI's frontier models breached Hugging Face's production infrastructure, logging over 17,000 events across a weekend. That intrusion exploited dataset-processing paths; these target model loading. Zafran said both point to the same weakness: AI repository content is treated as passive data when it can quietly cross into executable code.
Commenting on the OpenAI incident, Crystal Morin, cybersecurity strategist at AI cloud security firm Sysdig, said what caught the Hugging Face intrusion was "behavioral anomaly detection at the infrastructure level," not perimeter defenses. Teams should verify they can spot a privileged container spinning up from an application process, she said, and back up model weights as rigorously as databases.
Read more on Hugging Face threats: Malicious Hugging Face Repository Typosquats OpenAI
Check Separated from Code Load
All three flaws shared a root cause: the trust check runs at a different point from the actual code load. When a model is fetched, the check ran against the configuration file in the first of two sequential, non-atomic HTTP requests, so anything that makes the loader see custom code the check did not created a bypass.
CVE-2026-44827 (CVSS 8.8) exploited a string-formatting quirk. With no custom pipeline argument supplied, the loader built the filename None.py and checked whether it existed in the repository. The check used a different code path and did not flag None.py, so a repository containing that file passes while executing attacker code on load.
CVE-2026-45804 (CVSS 7.5) exploited the gap between the two requests. Modifying the configuration to reference custom code after the first request completed but before the second ran executes the injected code. Zafran's testing put the window at around 0.3 seconds, and the exploit required an uncached first download. Still, the firm noted a popular repository could achieve statistical success by briefly pushing a malicious config and reverting it.
Patched in May
Three further variants under CVE-2026-44513 (CVSS 8.8) shared the root cause, including one bypassing the check entirely when loading from a local snapshot. Zafran also disclosed a parallel flaw in Hugging Face's transformers package, which it said the security team has acknowledged.
Jeremy Powell, CISO at log management vendor Sumo Logic, said the defenses that mattered now were "the unglamorous ones": egress control, segmentation and credential hygiene, alongside detection operating at the speed of the attack.
Hugging Face released diffusers 0.38.0 on May 1, moving the security checks to the dynamic-module loading step and closing the identified variants. Zafran said it reported the first two flaws on March 19, and CVEs were published in May.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/hugging-face-diffusers-trust/