Full research report

Hugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Code

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

The FaceHugger disclosures represent a structurally significant finding in AI supply-chain security: the Hugging Face Diffusers trust_remote_code parameter was broadly treated as a meaningful security boundary, yet all three bypass methods demonstrate it was enforced at the wrong execution point in a two-phase, non-atomic loading architecture. The None.py bypass (CVE-2026-44827) is particularly notable because it requires no special configuration from the attacker — placing a misnamed file in any repository is sufficient to trigger execution on any machine loading that repository without explicit custom_pipeline arguments, and NVD confirms the technique is automatable. The TOCTOU root cause (CVE-2026-45804) is a race condition with a measured 0.3-second exploitation window, limiting but not eliminating practical exploitability. The patch in 0.38.0 correctly addresses the structural root cause by moving the trust gate to the actual code-loading point. The three-month gap between patching and public disclosure gave defenders a substantial remediation window, but the wide deployment of older pinned versions in CI/CD systems and container images represents a significant residual exposure surface that organisations should audit urgently.

What happened

Zafran Labs researchers Gal Zaban and Ido Shani disclosed three high-severity vulnerabilities, collectively named FaceHugger, in the Hugging Face Diffusers Python library. The flaws, reported to Hugging Face on 19 March 2026, allow a crafted repository to execute arbitrary code on any machine that loads it via DiffusionPipeline.from_pretrained(), even when the trust_remote_code safeguard is explicitly set to False or omitted. Hugging Face patched all three in Diffusers version 0.38.0, released 30 April 2026, roughly six weeks before CVEs were assigned and three months before the public research disclosure on 27 July 2026.

Affected scope

All Hugging Face Diffusers installations prior to version 0.38.0, representing approximately seven million monthly downloads and 200,000 daily installations. Red Hat AI Inference Server 3, Red Hat Enterprise Linux AI 3, and Red Hat OpenShift AI are confirmed downstream-affected products. Enterprise environments embedding Diffusers in CI/CD pipelines, container images, and inference services face residual exposure if still running pinned older releases; reported downstream partner surface includes Microsoft, Amazon Bedrock, NVIDIA, and Apple.

Technical assessment

All three variants share a root cause: the trust_remote_code security gate executes only during the first phase of a two-phase, non-atomic download operation — a classic Time-of-Check to Time-of-Use (TOCTOU) flaw. CVE-2026-44827 (CVSS 8.8) exploits a Python string-formatting quirk in _resolve_custom_pipeline_and_cls: when no custom_pipeline argument is supplied, the parameter defaults to the Python None object, which is interpolated as the literal filename None.py; a repository containing that file passes the gate unchecked and executes attacker code on load — no special arguments required. CVE-2026-45804 (CVSS 7.5) exploits a roughly 0.3-second window between two sequential HTTP calls (hf_hub_download and snapshot_download), during which an attacker with repository write access can substitute malicious content after the trust check but before the actual code load. CVE-2026-44513 (CVSS 8.8) covers three additional bypass paths: cross-repository research process loading, local-snapshot hybrid attacks, and malicious custom component injection. The patch in 0.38.0 relocates the security gate to the dynamic-module loading chokepoint in get_cached_module_file(), closing all known variants.

Recommended defensive actions

  1. Upgrade Hugging Face Diffusers to version 0.38.0 or later immediately; audit all applications, notebooks, inference services, and container images to confirm no pinned releases below 0.38.0 remain in production.
  2. Audit all calls to DiffusionPipeline.from_pretrained() in codebases and automated pipelines to ensure pretrained_model_name_or_path, custom_pipeline, and local snapshot directories reference only internally audited, fully trusted sources.
  3. Inspect local model snapshot directories for unexpected Python files — particularly None.py and any *.py files under component subdirectories (unet/, scheduler/) or the snapshot root — before invoking from_pretrained on unpatched installations.
  4. Review CI/CD research process configurations and container build definitions that include the Diffusers library to confirm the patched version is specified and pulled correctly in all build stages.
  5. Subscribe to Hugging Face Diffusers GitHub security advisories to receive prompt notification of future vulnerability disclosures.

Uncertainties and evidence gaps

  • Whether any threat actors independently discovered and weaponised these bypass techniques before the public disclosure on 27 July 2026 is unknown; no exploitation evidence in the wild has been reported by any verified source.
  • The full extent of downstream product exposure beyond confirmed Red Hat products is unverified; other vendors embedding Diffusers in managed AI services may not yet have issued advisories or notified customers.
  • NVD assessment was still pending for at least two of the three CVEs at the time of verification, meaning NIST-assigned CVSS scores may differ from the CNA-assigned scores; the July 2026 publication date for CVE-2026-45804 also suggests delayed NVD processing.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessNetwork-accessible Hugging Face Hub repository under attacker influence; user interaction required — the victim must invoke DiffusionPipeline.from_pretrained() against a repository the attacker has written to or crafted.
ComponentDiffusionPipeline.from_pretrained() API in Hugging Face Diffusers; specifically the _resolve_custom_pipeline_and_cls function and the hf_hub_download / snapshot_download HTTP request sequence in pipeline_loading_utils.py.
MechanismThe trust_remote_code security check runs only against the configuration obtained in the first HTTP request; code-loading operations in the second phase can access content that was not evaluated by the gate. Bypass paths include a None.py filename collision arising from Python None interpolation (CVE-2026-44827), a race-condition substitution window between the two sequential HTTP calls (CVE-2026-45804), and cross-repository and local-snapshot variants (CVE-2026-44513).
ImpactArbitrary code execution on the loading machine with the privileges of the invoking process; full confidentiality, integrity, and availability compromise. In enterprise contexts this includes CI/CD runners, inference servers, and containerised workloads.
DetectionPresence of unexpected Python files — especially None.py — in repository directories or local snapshots; anomalous process spawning or outbound network connections during library load operations; dependency-tree audits identifying Diffusers < 0.38.0.
MitigationUpgrade to Hugging Face Diffusers >= 0.38.0, which relocates the security gate to the dynamic-module loading step in get_cached_module_file(), closing all currently known bypass variants.
Exploitation status

No confirmed active exploitation in the wild; proof-of-concept code is referenced in NVD records for CVE-2026-44827 (automatable) and CVE-2026-45804 (not automatable); the Zafran Labs public research publication on 27 July 2026 did not release weaponisable exploit code.

Research process

The investigation began with a single outlet report about three newly disclosed vulnerabilities in the Hugging Face Diffusers library. NVD records for all three CVEs, a Red Hat security advisory, the primary GitHub security advisory, and the original Zafran Labs research publication were fetched and verified, providing independent corroboration across five distinct source domains. The patch timeline, technical root cause, and absence of active exploitation are consistent across all verified sources, supporting a high-confidence assessment.

  1. What does the primary outlet report, and are the stated CVE IDs and facts internally consistent?
    Fetched the Hacker News source article and extracted all stated claims.
    thehackernews.com ↗

    Confirmed three CVEs (CVE-2026-44513 CVSS 8.8, CVE-2026-44827 CVSS 8.8, CVE-2026-45804 CVSS 7.5) in Diffusers < 0.38.0, disclosed by Zafran Labs researchers Gal Zaban and Ido Shani, fixed in 0.38.0 released May 2026; no active exploitation stated.

    why Established the factual baseline before seeking independent verification; confirmed researcher identities, CVE IDs, and fix version.

  2. Do independent security outlets corroborate the CVE IDs, severity, scope, and downstream impact?
    Searched for FaceHugger and all three CVE IDs; fetched CyberSecurityNews and Infosecurity Magazine coverage.
    cybersecuritynews.com ↗

    Both outlets independently confirmed CVE IDs, CVSS scores, and fix version; CyberSecurityNews identified the ~0.3-second TOCTOU race window, downstream partner exposure (Microsoft, Amazon Bedrock, NVIDIA, Apple), and scale (~7 million monthly downloads); Infosecurity Magazine confirmed the full disclosure timeline.

    why Corroboration from two independent domains strengthens the factual claims and extends scope beyond the source article.

  3. What do NVD records confirm about exploitation status, PoC availability, and affected products?
    Fetched NVD detail pages for all three CVEs.
    nvd.nist.gov ↗

    CVE-2026-44513 published 14 May 2026 (CVSS 8.8; Red Hat AI Inference Server 3, RHEL AI 3, RHOAI listed as affected); CVE-2026-44827 published 14 May 2026 (CVSS 8.8, PoC available and automatable); CVE-2026-45804 published 15 July 2026 (CVSS 7.5, PoC available, automation not feasible). No active exploitation in the wild noted across any entry.

    why NVD provides the authoritative exploitation-status baseline and confirmed downstream enterprise product impact via Red Hat listings.

  4. What does the primary GitHub security advisory confirm about patch provenance and fix mechanism?
    Fetched the GitHub Advisory GHSA-98h9-4798-4q5v for CVE-2026-44513.
    github.com ↗

    CNA advisory confirms affected versions < 0.38.0, patched version 0.38.0, published 1 May 2026. Fix PR #13448 relocated the security gate from DiffusionPipeline.download() to get_cached_module_file() in dynamic_modules_utils.py, closing all identified variants.

    why Vendor-level advisory provides authoritative patch provenance and confirms the fix mechanism, establishing that all variants share a single structural correction.

  5. Does a Red Hat advisory confirm downstream enterprise product impact and fix availability?
    Fetched the Red Hat CVE page for CVE-2026-44513.
    access.redhat.com ↗

    Red Hat rates severity as Important (CVSS 8.8); lists Red Hat AI Inference Server 3, RHEL AI 3, and OpenShift AI as affected with fixes available; cites CWE-358 alongside CWE-94.

    why Confirms that enterprise distributions package the vulnerable library and have issued remediation, establishing operational impact beyond the upstream Python package.

  6. What does the original Zafran Labs research publication disclose about technical detail and exploitation evidence?
    Fetched the Zafran Labs FaceHugger research page.
    zafran.io ↗

    Confirmed full disclosure timeline (19 March 2026 report, 30 April 2026 patch, 27 July 2026 public release); detailed technical descriptions of all three bypass variants including the None.py interpolation mechanism and the ~0.3-second race window; no exploitation in the wild identified; no weaponisable exploit code published. Research attributed to Zafran's Project DarkSide initiative examining AI infrastructure security.

    why Primary source from discovering researchers; confirms no current exploitation, provides authoritative timeline, and establishes that technical detail is available without public weaponisation — informing the PoC-available-but-not-exploited assessment.

Named in this story
ActorsZafran Labs (discovering researchers; defensive context)
TargetsEnterprise AI pipelines using Hugging Face DiffusersCI/CD systems embedding DiffusersContainer images pinning Diffusers < 0.38.0Red Hat AI Inference Server 3Red Hat Enterprise Linux AI (RHEL AI) 3Red Hat OpenShift AI (RHOAI)
Related CVEs CVE-2026-44513CVE-2026-44827CVE-2026-45804

Research coverage

All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 2 registered sources supplied useful evidence (2 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 59 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
NVDcve ok900 records Primary evidence3 matched items Supplied a vendor or government advisory opened and verified during focused research.
The Hacker Newsnews ok10 records Primary evidence1 matched items Published the source report used to frame and date the event.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
BleepingComputernews ok7 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CISA KEVkev ok1657 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5309 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok260 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok669 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1007 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok15 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok7 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1588 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok3 records Checked — no match The source completed, but none of its retained records matched this story.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok7 records Checked — no match The source completed, but none of its retained records matched this story.
Sigma Rulesresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 6 opened outside the registered collection
References & evidence
PoC & exploit code1
Zafran Labs FaceHugger Research — Technical Analysis of None.py, TOCTOU and Cross-Repository Bypass Methods zafran.io ↗

Original research publication describing all three bypass mechanisms in technical detail; no weaponisable exploit code released.

Vendor & gov advisories5
GitHub Advisory GHSA-98h9-4798-4q5v — CVE-2026-44513 (trust_remote_code bypass via custom_pipeline and local custom components) github.com ↗

Primary CNA advisory; confirms affected versions < 0.38.0, patch in 0.38.0, and fix PR #13448 relocating the security gate.

NVD — CVE-2026-44513 nvd.nist.gov ↗

Confirms CVSS 8.8, CWE-94/CWE-358, and lists Red Hat AI Inference Server 3, RHEL AI 3, and OpenShift AI as affected downstream products.

NVD — CVE-2026-44827 nvd.nist.gov ↗

Confirms CVSS 8.8, CWE-94, PoC available and automatable; published 14 May 2026.

NVD — CVE-2026-45804 nvd.nist.gov ↗

Confirms CVSS 7.5, CWE-367 (TOCTOU), PoC available but automation not feasible; published 15 July 2026.

Red Hat Security Advisory — CVE-2026-44513 access.redhat.com ↗

Confirms Red Hat AI Inference Server 3, RHEL AI 3, and OpenShift AI as affected; fixes available; rates severity as Important (CVSS 8.8).

Analysis & research2
Hugging Face Diffusers Vulnerabilities Enable Remote Code Execution Through Malicious AI Models — CyberSecurityNews cybersecuritynews.com ↗

Independent corroboration identifying the ~0.3-second TOCTOU race window and downstream partner exposure (Microsoft, Amazon Bedrock, NVIDIA, Apple).

Bugs in Hugging Face Diffusers Bypass Custom Code Safeguard — Infosecurity Magazine infosecurity-magazine.com ↗

Independent coverage providing the disclosure timeline: 19 March 2026 report, 30 April 2026 patch, May 2026 CVE assignment, 27 July 2026 public research.