Three high-severity flaws in vulnerable versions of Hugging Face’s diffusers library let crafted model repositories silently execute arbitrary code during affected loading flows, bypassing the safeguard built to prevent exactly that.
According to research from threat exposure management firm Zafran Security published on July 27, the flaws defeated trust_remote_code, the check meant to stop unreviewed code running when a model is fetched.
The library draws roughly seven million downloads a month, close to 200,000 a day, sitting inside production AI pipelines, CI/CD systems and container images.
The findings land days after OpenAI’s frontier models breached Hugging Face’s production infrastructure, logging over 17,000 events across a weekend. That intrusion exploited dataset-processing paths; these target model loading. Zafran said both point to the same weakness: AI repository content is treated as passive data when it can quietly cross into executable code.
Commenting on the OpenAI incident, Crystal Morin, cybersecurity strategist at AI cloud security firm Sysdig, said what caught the Hugging Face intrusion was “behavioral anomaly detection at the infrastructure level,” not perimeter defenses. Teams should verify they can spot a privileged container spinning up from an application process, she said, and back up model weights as rigorously as databases.
Read more on Hugging Face threats: Malicious Hugging Face Repository Typosquats OpenAI
Check Separated from Code Load
All three flaws shared a root cause: the trust check runs at a different point from the actual code load. When a model is fetched, the check ran against the configuration file in the first of two sequential, non-atomic HTTP requests, so anything that makes the loader see custom code the check did not created a bypass.
CVE-2026-44827 (CVSS 8.8) exploited a string-formatting quirk. With no custom pipeline argument supplied, the loader built the filename None.py and checked whether it existed in the repository. The check used a different code path and did not flag None.py, so a repository containing that file passes while executing attacker code on load.
CVE-2026-45804 (CVSS 7.5) exploited the gap between the two requests. Modifying the configuration to reference custom code after the first request completed but before the second ran executes the injected code. Zafran’s testing put the window at around 0.3 seconds, and the exploit required an uncached first download. Still, the firm noted a popular repository could achieve statistical success by briefly pushing a malicious config and reverting it.
Patched in May
Three further variants under CVE-2026-44513 (CVSS 8.8) shared the root cause, including one bypassing the check entirely when loading from a local snapshot. Zafran also disclosed a parallel flaw in Hugging Face’s transformers package, which it said the security team has acknowledged.
Jeremy Powell, CISO at log management vendor Sumo Logic, said the defenses that mattered now were “the unglamorous ones”: egress control, segmentation and credential hygiene, alongside detection operating at the speed of the attack.
Hugging Face released diffusers 0.38.0 on May 1, moving the security checks to the dynamic-module loading step and closing the identified variants. Zafran said it reported the first two flaws on March 19, and CVEs were published in May.
