Three high-severity security vulnerabilities have been identified in Hugging Face's Diffusers library, allowing for malicious model repositories to stealthily execute arbitrary code on machines that load them This article explores vulnerabilities identified hugging. . Researchers at Zafran Labs, Gal Zaban and Ido Shani, noted that these flaws bypass trust_remote_code, a safeguard designed to prevent unreviewed code from running in custom pipelines during loading processes.
These vulnerabilities have been collectively named FaceHugger, as Hugging Face has become the "GitHub of the AI era." The library's embedding into production pipelines, CI/CD systems, and container images makes it highly susceptible to security threats.
Each variant can be traced back to a case of Time-of-Check to Time-of-Use (TOCTOU), with the model download designed as two sequential, non-atomic HTTP requests instead of one single atomic operation and the "trust_remote_code" security gate configured to run only against the first phase. The underlying issue is that artifacts pulled from AI repositories are often treated as passive data when configuration files, loaders, and custom pipeline code can quietly convert a routine model load into an initial-access vector. If immediate patching is not feasible, the project maintainers recommend the following workarounds: Only call from_pretrained with `pretrained_model_name_or_path`, `custom_pipeline`, and `local_snapshot_directories` from fully trusted sources that have been audited.
A simple model download could lead to arbitrary code execution if security measures like trust_remote_code are circumvented," Zafran stated.
