Hugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Code
Three high-severity vulnerabilities (CVE-2026-44827, CVE-2026-45804, CVE-2026-44513) in Hugging Face Diffusers allow arbitrary code execution by bypassing the trust_remote_code safeguard All flaws stem from a Time-of-Check to Time-of-Use (TOCTOU) race condition where the security gate runs only against the first of two non-atomic HTTP requests during model loading The vulnerabilities were patched in Diffusers version 0.38.0 released in early May 2026 Any user invoking DiffusionPipeline.from_pret
Analysis
TL;DR
- Three high-severity vulnerabilities (CVE-2026-44827, CVE-2026-45804, CVE-2026-44513) in Hugging Face Diffusers allow arbitrary code execution by bypassing the trust_remote_code safeguard
- All flaws stem from a Time-of-Check to Time-of-Use (TOCTOU) race condition where the security gate runs only against the first of two non-atomic HTTP requests during model loading
- The vulnerabilities were patched in Diffusers version 0.38.0 released in early May 2026
- Any user invoking DiffusionPipeline.from_pretrained with custom pipelines is impacted, posing significant AI supply chain risks
- Workarounds include auditing trusted sources, inspecting snapshots for unexpected .py files, and avoiding cross-repository custom_pipeline references
Why It Matters
This disclosure highlights a critical gap in AI supply chain security: model repositories are often treated as passive data when they can silently execute arbitrary code during routine loading operations. As Hugging Face becomes the de facto hub for AI model distribution in enterprise environments, vulnerabilities in widely adopted libraries like Diffusers (8.1+ million downloads in July 2026) can grant attackers extensive access through production pipelines, CI/CD systems, and container images.
Technical Details
- CVE-2026-44827 (CVSS 8.8): Code injection via a crafted pipeline named "None.py" in the custom_pipeline flow, bypassing trust_remote_code=False by exploiting the TOCTOU gap between the two HTTP download phases.
- CVE-2026-45804 (CVSS 7.5): Race condition allowing an attacker to modify the repository configuration between the hf_hub_download and snapshot_download HTTP calls, injecting arbitrary code into the loading process.
- CVE-2026-44513 (CVSS 8.8): Another code injection variant through the custom_pipeline flow that similarly circumvents the trust_remote_code check due to the same root cause.
- Root Cause: The trust_remote_code security gate operates only during the first phase of model loading, while the actual code execution occurs in a second, unmonitored phase—creating a classic TOCTOU vulnerability where the loader can see custom code that the initial trust check did not evaluate.
- Affected Scope: Any invocation of DiffusionPipeline.from_pretrained with custom pipelines; patched in Diffusers 0.38.0 (May 2026).
Industry Insight
- Enterprises relying on Hugging Face must treat all model repositories as untrusted code sources by default, implementing strict scanning and auditing of configuration files, loaders, and custom pipeline code before integration into production pipelines.
- Security teams should enforce the recommended workarounds immediately for any systems unable to patch to Diffusers 0.38.0, including snapshot inspection for unexpected .py files in component subdirectories and restricting custom_pipeline references to fully audited repositories.
- This incident underscores the broader need for AI supply chain security frameworks that address the unique risk of configuration-to-execution transitions in model loading workflows, prompting organizations to adopt zero-trust principles for AI artifact ingestion.
Disclaimer: The above content is generated by AI and is for reference only.