Three high-severity vulnerabilities have been discovered within the vulnerable versions of Hugging Face’s diffusers library, which allows malicious model repositories to silently execute arbitrary code during loading processes, effectively bypassing existing safeguards meant to prevent such actions. This significant information was disclosed in research published by Zafran Security, a firm specializing in threat exposure management, on July 27.
According to Zafran’s analysis, the identified vulnerabilities successfully defeat the trust_remote_code feature—specifically designed to prevent unreviewed or potentially harmful code from being executed when models are downloaded. Hugging Face’s diffusers library is widely used, witnessing around seven million downloads per month, averaging nearly 200,000 downloads daily. This places it at the core of numerous production AI pipelines, Continuous Integration/Continuous Deployment (CI/CD) systems, and container images, highlighting the pervasive nature of the threat.
The timing of the findings is particularly critical, arriving just days after an intrusion incident involving OpenAI’s frontier models, which breached Hugging Face’s production infrastructure. This incident was notable for generating over 17,000 log events over a single weekend and exploited vulnerabilities in dataset processing paths, particularly those associated with model loading. Zafran posits that both incidents illustrate a shared vulnerability: content within AI repositories is often treated as mere passive data, when in fact it can evolve into executable code, posing serious risks to security.
In a statement regarding the OpenAI incident, Crystal Morin, a cybersecurity strategist at AI cloud security firm Sysdig, emphasized the importance of adopting improved detection strategies. She noted that the Hugging Face breach was identified through "behavioral anomaly detection at the infrastructure level," rather than relying solely on perimeter defenses. Morin highlighted the need for teams to ensure they can identify when a privileged container is initiated from an application process, and suggested that organizations should back up their model weights as rigorously as they do their databases.
Check Separated from Code Load
All three vulnerabilities stem from a common root cause: the trust check operates at a different point in the process than where the actual code load takes place. When a model is fetched, the check is performed against the configuration file during the initial of two sequential, non-atomic HTTP requests. This misalignment creates a situation where anything that allows the loader to recognize custom code not previously detected by the check can easily bypass security measures.
The first identified vulnerability, CVE-2026-44827 (with a CVSS score of 8.8), exploits a quirk of string formatting. If no custom pipeline argument is provided, the loader generates a filename labeled None.py and checks its existence within the repository. However, because this check follows a different code path, it fails to flag None.py, allowing an attacker’s code to be executed upon loading from a repository containing that file.
The second vulnerability, CVE-2026-45804 (CVSS 7.5), takes advantage of the interval between the two requests. By modifying the configuration to reference custom code after the first request has been completed, but before the second request is executed, an attacker can run the injected code within approximately 0.3 seconds. Zafran’s tests indicated that while an uncached first download is required, a popular repository could achieve statistical success by temporarily pushing a malicious configuration before reverting back to its original state.
Patched in May
Further variants related to CVE-2026-44513 (CVSS 8.8) share the same root vulnerability, including one that entirely bypasses the trust check when loading from a local snapshot. Alongside this, Zafran also brought to light a separate flaw in Hugging Face’s transformers package, which the security team had acknowledged.
In light of these vulnerabilities, Jeremy Powell, the Chief Information Security Officer at log management vendor Sumo Logic, underscored the importance of implementing fundamental security measures such as egress control, segmentation, and maintaining proper credential hygiene. Additionally, he stressed the need for detection systems that can operate with the rapidity required to counteract these threats.
To address these vulnerabilities, Hugging Face released diffusers version 0.38.0 on May 1, which involved repositioning the security checks to the dynamic module loading stage to effectively close the identified security gaps. Zafran reported the first two vulnerabilities to Hugging Face on March 19, with relevant CVEs published in May. This proactive response is a crucial step in securing the integrity of AI models and safeguarding against potential supply chain attacks.