Trust Check vs. Code Load: A Fatal Gap
Three high-severity vulnerabilities in Hugging Face’s Diffusers library allowed crafted model repositories to quietly run arbitrary code during loading — defeating the very safeguard meant to stop that. The flaws, uncovered by Zafran Security, targeted trust_remote_code, the safety check designed to prevent unreviewed code from executing when a model is fetched.
The library sees roughly seven million downloads per month. Nearly 200,000 a day. It sits inside production AI pipelines, CI/CD systems, and container images. That makes these bugs more than academic.
Zafran published its findings on July 27. The research arrives just days after OpenAI‘s frontier models breached Hugging Face’s production infrastructure. That intrusion logged over 17,000 events across a single weekend. It exploited dataset-processing paths. These flaws target model loading. Zafran says both incidents point to the same root weakness: AI repository content is treated as passive data, but it can quietly cross into executable code.
Crystal Morin, cybersecurity strategist at cloud security firm Sysdig, said what caught the OpenAI incident was — not perimeter defenses — but behavioral anomaly detection at the infrastructure level. Teams should verify they can spot a privileged container spinning up from an application process, she said. And back up model weights as rigorously as databases.
Three CVEs, One Root Cause
All three flaws share a common root cause: the trust check runs at a different point from the actual code load. When a model is fetched, the check runs against the configuration file in the first of two sequential, non-atomic HTTP requests. Anything that makes the loader see custom code that the check missed creates a bypass.
CVE-2026-44827 (CVSS 8.8) exploits a string-formatting quirk. When no custom pipeline argument is supplied, the loader builds the filename None.py and checks whether it exists in the repository. The check uses a different code path and does not flag None.py. So a repository containing that file passes the trust check while executing attacker code on load.
CVE-2026-45804 (CVSS 7.5) exploits the gap between those two HTTP requests. An attacker modifies the configuration to reference custom code after the first request completes but before the second runs. Zafran’s testing put the window at around 0.3 seconds. The exploit requires an uncached first download. Still, the firm notes a popular repository could achieve statistical success — briefly push a malicious config, then revert it.
CVE-2026-44513 (CVSS 8.8) covers three further variants sharing the same root cause. One bypasses the check entirely when loading from a local snapshot. Zafran also disclosed a parallel flaw in Hugging Face’s Transformers package, which it says the security team has acknowledged.
Patched in May, But the Lesson Lingers
Hugging Face released Diffusers 0.38.0 on May 1. The update moves the security checks to the dynamic-module loading step, closing the identified variants. Zafran reported the first two flaws on March 19; CVEs were published in May.
Jeremy Powell, CISO at log management vendor Sumo Logic, says the defenses that matter now are the unglamorous ones. Egress control. Segmentation. Credential hygiene. Detection operating at the speed of the attack.
The takeaway is blunt: AI supply chain security can’t rely on a single trust flag. The code you load can differ from the code you checked. Treat model repos like any other software dependency — scan them, sandbox them, and don’t assume trust_remote_code means safe. For a deeper look at related threats, see our coverage of malicious Hugging Face repository typosquatting attacks and how to secure AI model loading pipelines.
