Hugging Face Diffusers Vulnerabilities Enable Code Execution Attacks

Zafran Labs identified high-severity vulnerabilities in Hugging Face's diffusers library, allowing malicious model repositories to execute arbitrary code on client machines. The vulnerabilities bypass the trust_remote_code safeguard, which is intended to prevent unreviewed code execution. Hugging Face's diffusers library, which sees around 200,000 installations daily, is integral to AI software supply chains. The flaws stem from a Time-of-Check to Time-of-Use (TOCTOU) issue, where security checks occur at different stages of the model loading process. This incident follows a significant breach attributed to OpenAI's models, which exploited dataset-processing paths. The vulnerabilities are documented as CVE-2026-44827, CVE-2026-45804, and CVE-2026-44513, with varying CVSS scores indicating their severity. Security experts emphasize the need for improved detection and response strategies to mitigate such risks.

Key Points: • Three high-severity vulnerabilities in Hugging Face's diffusers library allow arbitrary code execution. • The flaws bypass the trust_remote_code safeguard, affecting around 200,000 installations daily. • The vulnerabilities are linked to a Time-of-Check to Time-of-Use (TOCTOU) flaw in the model loading process.