Hugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Code

Three high-severity vulnerabilities have been discovered in Hugging Face's Diffusers library, allowing malicious model repositories to execute arbitrary code on systems that load them. Dubbed FaceHugger, these flaws undermine the trust_remote_code safeguard meant to prevent unreviewed code from running. The issues stem from a design flaw involving TOCTOU (Time-of-Check to Time-of-Use) race conditions and improper validation of downloaded components. The affected CVEs are CVE-2026-44827, CVE-2026-45804, and CVE-2026-44513. These were fixed in Diffusers version 0.38.0. Users relying on custom pipelines should update immediately.