# Security Flaws in Hugging Face Diffusers Expose AI Supply Chain Risks

*Published August 5, 2026*
*Source: [https://thehackernews.com/2026/08/hugging-face-diffusers-flaws-could-let.html](https://thehackernews.com/2026/08/hugging-face-diffusers-flaws-could-let.html)*

## Executive Summary

Critical vulnerabilities in Hugging Face's Diffusers library allow for arbitrary code execution, putting AI supply chains at risk. These issues have been addressed in a recent update, but highlight the need for treating AI model repositories with caution.

## Article

Significant security vulnerabilities have been discovered in the Diffusers library of Hugging Face, a prominent platform known for its extensive AI model repositories. These flaws, collectively named FaceHugger, allow crafted model repositories to execute arbitrary code on systems that load them, effectively bypassing the trust_remote_code safeguard meant to prevent unreviewed code execution. Researchers from Zafran Labs, Gal Zaban and Ido Shan, highlighted these issues, emphasizing the potential for attackers to gain unauthorized access to enterprise environments where Hugging Face libraries are often embedded.

Diffusers is a widely-used Python package featuring state-of-the-art pretrained diffusion models for generating videos, images, and audio. It was downloaded over 8.1 million times in July 2026 alone. The library's key function involves loading models from the Hugging Face hub using the DiffusionPipeline API, which relies on configuration files for initialization. The trust_remote_code parameter is intended to control whether custom code from model repositories can execute during the loading process. However, the vulnerabilities identified stem from a Time-of-Check to Time-of-Use (TOCTOU) issue, allowing malicious code to bypass security checks by exploiting the sequential nature of HTTP requests used in the model download process.

Following responsible disclosure, these vulnerabilities were addressed in Diffusers version 0.38.0, released in May 2026. Users employing the DiffusionPipeline.from_pretrained with custom pipelines are particularly affected. Given the reliance on platforms like Hugging Face in enterprise settings, the researchers stress the importance of treating AI model repositories as potentially untrusted code. If immediate patching is not feasible, project maintainers have suggested specific workarounds to mitigate the risk.