Hugging Face AI models can run attacker code
Security researchers found three bugs in Hugging Face's diffusers software that let a booby-trapped AI model silently run its own code the moment a developer's system loads it. The safeguard meant to block exactly this kind of hidden code failed to catch it.
- Report priority
- Medium
- Targets
- Hugging Face diffusers
How it works
Diffusers checks whether a model repository contains custom code in one web request, then actually loads that code in a separate later request, so a repository can be arranged to look clean during the check but still slip in code that runs during loading.
What to do
Check your installed version with pip and compare it against 0.38.0; anything older than that release contains the flaw. Run python3 -m pip show diffusers to see the version currently installed in your environment.
Run this in the application environment you want to check:
python3 -m pip show diffusersUpdate to diffusers 0.38.0 or later, which moves the safety check to the actual code-loading step and closes these bypasses. Treat trust_remote_code as unsafe for any model repository you did not personally review.
Technical details
Affected software: Hugging Face diffusers
CVE-2026-44827 (CVSS 8.8) abused a fallback where an unset custom_pipeline argument caused the loader to look for a file literally named None.py, which the trust_remote_code check path did not evaluate. CVE-2026-45804 (CVSS 7.5) exploited a roughly 0.3 second gap between the initial config fetch and the later code fetch, letting an attacker swap in malicious code mid-flow on an uncached first download. CVE-2026-44513 (CVSS 8.8) covered further variants, including a full bypass when loading from a local snapshot.
All three share one root cause: the trust check and the code load are not atomic. A related flaw in Hugging Face's transformers package was also reported and acknowledged.