A set of high-severity vulnerabilities in Hugging Face’s diffusers library enables malicious model repositories to silently execute arbitrary code on any machine that loads them This article explores vulnerabilities hugging. . These flaws circumvent trust_remote_code, a safeguard designed to prevent unreviewed code from running during custom pipeline loading processes, raising serious concerns for an AI ecosystem relying on Hugging Face as foundational infrastructure.
Because diffusers runs inside production pipelines, CI/CD systems, and container images, a single compromised model load can grant an attacker initial access deep within an enterprise network. The scale of exposure is significant: diffusers draws roughly 7 million downloads per month, close to 200,000 installations daily, while Hugging Face handles more than 100 million monthly downloads across enterprise use through partnerships with Microsoft, Amazon Bedrock, NVIDIA, and Apple.
This research closely follows Hugging Face's July 2026 incident, where a malicious dataset exploited two code-execution paths in their data-processing pipeline, enabling an attacker to run code on a worker, gain node-level access, harvest cloud and cluster credentials, and laterally move into internal clusters. These findings extend Zafran Labs’ ongoing Project DarkSide research, which previously uncovered critical vulnerabilities in the Chainlit framework exposing cloud API keys and in the Dify platform enabling cross-tenant data wiretapping. Together, they demonstrate how rapidly adopted AI infrastructure reintroduces long-standing classes of software vulnerabilities at massive scale.
