Artificial intelligence (AI) security has taken a hit with the disclosure of three critical vulnerabilities in **Hugging Face**'s **Diffusers** library. These flaws, collectively named **FaceHugger**, could enable malicious actors to execute arbitrary code on machines loading crafted model repositories, directly impacting the integrity of the AI supply chain. Researchers Gal Zaban and Ido Shani from **Zafran Labs** highlighted that these vulnerabilities specifically bypass `trust_remote_code`, a crucial safeguard designed to prevent unreviewed code from running during the custom pipeline loading process. This circumvention opens a dangerous avenue for supply chain attacks within enterprise AI environments.  ### The GitHub of AI Era Under Threat **Hugging Face** has rapidly become a central repository for AI models and libraries, often referred to as the "GitHub of the AI era." Its widespread adoption in enterprise production pipelines, CI/CD systems, and container images means that vulnerabilities in core libraries like **Diffusers** can grant attackers extensive access and control. **Diffusers** is a **Python** package providing a library of state-of-the-art (SOTA) pretrained diffusion models for generating diverse content, including videos, images, and audio. With over 8.1 million downloads in July 2026 alone, its reach underscores the severity of these newly found flaws. ### How the Bypass Works The library's **DiffusionPipeline** API is designed to load models locally from **Hugging Face** hub repositories. This process involves using a configuration file to initialize specific pipeline and component classes, alongside custom pipeline code. Crucially, the `trust_remote_code` parameter in **Diffusers** acts as a security gate, controlling whether custom **Python** code within a model repository is allowed to execute during `from_pretrained()` loading. Setting it to `True` permits execution, while `False` or omission blocks unverified code. **Zafran Labs** explained that the core issue lies in the `trust` check occurring entirely in the first phase of the loading process. This allows any method that presents custom code to the loader *after* the initial gate check to bypass the `trust_remote_code` mechanism, leading to arbitrary code execution.  ### Time-of-Check to Time-of-Use (TOCTOU) Exploits Each **FaceHugger** variant stems from a Time-of-Check to Time-of-Use (TOCTOU) vulnerability. The model download mechanism involves two sequential, non-atomic HTTP requests rather than a single atomic operation. The `trust_remote_code` security gate is configured to run only against the first request, creating a window for manipulation. Here are the specific vulnerabilities: * **CVE-2026-44827** (CVSS score: 8.8): A code injection vulnerability allowing arbitrary code loading via the `custom_pipeline` flow from a Hub repository. This is achieved through a crafted pipeline named "None.py," bypassing `trust_remote_code=False` (or its default omission). * **CVE-2026-45804** (CVSS score: 7.5): A race condition vulnerability enabling arbitrary code introduction by modifying the configuration between the `hf_hub_download` and `snapshot_download` HTTP calls to the Hub, leading to code execution. * **CVE-2026-44513** (CVSS score: 8.8): Another code injection vulnerability that allows arbitrary code to be loaded through the `custom_pipeline` flow from a Hub repository, even when `trust_remote_code=False` (or omitted). ### Patching and Mitigations Following responsible disclosure, these vulnerabilities were addressed in **Diffusers** version **0.38.0**, released in early May 2026. All users who invoke `DiffusionPipeline.from_pretrained` with custom pipelines are impacted and urged to update immediately. For organizations where immediate patching isn't feasible, the project maintainers have recommended several workarounds: * Only call `from_pretrained` with `pretrained_model_name_or_path`, `custom_pipeline`, and local snapshot directories from fully trusted and audited sources. * Avoid passing `custom_pipeline=` pointing to a Hub repository different from the primary `pretrained_model_name_or_path` before thoroughly reviewing its `pipeline.py` file. * Before calling `from_pretrained` on a local snapshot, meticulously inspect the snapshot for any unexpected `*.py` files, particularly within component subdirectories (e.g., `unet/`, `scheduler/`) and at the snapshot root. These findings underscore the critical necessity of treating AI model repositories as untrusted code. As enterprise reliance on platforms like **Hugging Face** continues to grow, a seemingly routine model download can easily become an initial-access vector for arbitrary code execution if security boundaries are compromised.