--- title: "The diffusers trust_remote_code Bypass Was Patched in May" pubDatetime: 2026-08-03T23:01:00.000Z description: "Three CVEs let a malicious Hugging Face repo run code with trust_remote_code left off. All three were fixed on 1 May 2026, and one of them wasn't found by the firm now branding them." tags: [hugging-face, ai-security, supply-chain, vulnerability, vulnerability-disclosure, security, 2026, 2026-q3, 2026-08] --- > [!tldr] TL;DR > Three flaws in Hugging Face's `diffusers` library let a malicious model repo execute arbitrary Python even with `trust_remote_code` at its default `False`. All three were fixed in [diffusers 0.38.0](https://pypi.org/project/diffusers/0.38.0/) on 1 May 2026, 94 days before today's press cycle, so upgrading is the entire remediation. The root cause deserves more attention than the branding: the library fetched a repo in two separate HTTP calls and only checked trust on the first one. Zafran Labs bundled the bugs as "FaceHugger," but Hugging Face's advisory credits one of the three, CVSS 8.8, to a different reporter. Doing the cautious thing bought you nothing. A `diffusers` user who left `trust_remote_code` at its default `False`, who deliberately declined to run a stranger's Python, could still be handed arbitrary code by a malicious model repo through an ordinary `from_pretrained` call. The flag Hugging Face has pointed people toward for years was the exact control these three CVEs walked past. The exposed population is large. Zafran Labs counts `diffusers` at roughly seven million downloads a month, and around 200,000 a day. ## Three CVEs, two reporters, one root cause All three bugs come from the same mistake. `diffusers` pulls a model repository in two non-atomic HTTP calls, and the `trust_remote_code` gate fired against the first call rather than at the point where a Python module gets imported and executed. The 0.38.0 fix moved the check into `get_cached_module_file`, next to the code that does the importing. The variants differ only in how they reach that seam. CVE-2026-44827 is the "None.py" case, [CVSS 8.8](https://github.com/huggingface/diffusers/security/advisories/GHSA-j7w6-vpvq-j3gm). CVE-2026-45804 is a [TOCTOU race](https://github.com/huggingface/diffusers/security/advisories/GHSA-7wx4-6vff-v64p) between the two fetches, CVSS 7.5. CVE-2026-44513 covers three [`custom_pipeline` and local-snapshot variants](https://github.com/huggingface/diffusers/security/advisories/GHSA-98h9-4798-4q5v), also CVSS 8.8. Zafran Labs reported the first two on 19 March 2026 and published its writeup on [27 July](https://www.zafran.io/resources/facehugger-vulnerabilities-in-hugging-face-diffusers-open-door-to-supply-chain-attacks-on-enterprise-ai), seven days ago. CVE-2026-44513 came from an independent reporter, "Vancir," with the fix credited to "hlky." Hugging Face's advisory says so, and Zafran's own post acknowledges it. That nuance survived poorly in the coverage, which describes all three as one firm's discovery. A third of the bundled CVE count belongs to someone outside the brand. Naming a bug family is a marketing act as much as a research one, and aggregation is where the credit blurs, since the name attaches to whoever published the writeup rather than to whoever filed each report. ## Preconditions narrow the real-world exploit Read the advisories rather than the headlines and the preconditions pile up fast. The TOCTOU variant needs an unpinned `revision`, no pre-existing local cache, and an attacker winning a race window of a fraction of a second. Hugging Face's advisory puts that window near half a second; Zafran's writeup says roughly 0.3 seconds. Both figures describe a bug that fails against pinned commits and against anything already cached. The other variants still require the victim to call `from_pretrained` against a repo the attacker controls or has modified. Nothing here is wormable and nothing spreads on its own. No source reviewed shows a malicious repository caught using these techniques on the Hub. The realistic threat is an engineer pulling an unvetted image-generation model by name, which is common enough to matter and specific enough to defend against. Pin your revisions. That advice was already correct before these CVEs existed. ## The consent argument these bugs undercut In an [August 2025 discussion thread](https://github.com/huggingface/diffusers/discussions/12033), diffusers maintainer asomoza argued that setting `trust_remote_code=True` is "strong consent," on par with `torch.load()`'s own arbitrary-code behavior. Maintainer DN6 floated an environment-variable control as "a first step." Both positions assume the flag works. That assumption is what these CVEs break. The debate over whether users understand the risk of opting in was moot while the default-off path executed code anyway. The threat model was wrong before the implementation was. To be fair to Hugging Face, the company has treated arbitrary-code-on-load as a live category of risk for years. It runs [pickle scanning](https://huggingface.co/docs/hub/en/security-pickle) on the Hub and built `safetensors` precisely because loading a model shouldn't mean running one. The gap here sat in one client library's control flow. ## Why a three-month-old patch is today's news Coverage today from The Hacker News, Infosecurity Magazine and others describes flaws patched on 1 May. Zafran published on 27 July. The press followed a week later, which is a research firm's publication calendar setting the news agenda, working as intended. The story still earns telling, for reasons that have nothing to do with urgency. The fix for all three CVEs is one version bump. Anyone running a release from the last three months is done, and anyone pinned to an older version has a straightforward upgrade and no fire to put out. What outlives the news cycle is the design lesson. A security check placed away from the operation it guards will eventually stop guarding it, and a two-call fetch is exactly the kind of seam where "checked" and "executed" drift apart. The fix landing in `get_cached_module_file` is the most useful line in this whole disclosure. --- *Sources: [GHSA-j7w6-vpvq-j3gm](https://github.com/huggingface/diffusers/security/advisories/GHSA-j7w6-vpvq-j3gm) • [GHSA-7wx4-6vff-v64p](https://github.com/huggingface/diffusers/security/advisories/GHSA-7wx4-6vff-v64p) • [GHSA-98h9-4798-4q5v](https://github.com/huggingface/diffusers/security/advisories/GHSA-98h9-4798-4q5v) • [Zafran Labs: FaceHugger](https://www.zafran.io/resources/facehugger-vulnerabilities-in-hugging-face-diffusers-open-door-to-supply-chain-attacks-on-enterprise-ai) • [diffusers 0.38.0 on PyPI](https://pypi.org/project/diffusers/0.38.0/)* *Coverage: [The Hacker News](https://thehackernews.com/2026/08/hugging-face-diffusers-flaws-could-let.html) • [Infosecurity Magazine](https://www.infosecurity-magazine.com/news/hugging-face-diffusers-trust/)* *Related on this blog: [54 Fake CVEs in Four Days, and Nobody Checked](/posts/fake-cves-ai-slop-honor-system) • [JADEPUFFER's 19-Day Upgrade: Ransomware Built to Destroy AI Models](/posts/jadepuffer-encforge-ai-model-ransomware) • [The Payload Was Never in the Package](/posts/ai-agent-skill-poisoning)*