CVE-2026-44827, CVE-2026-45804, CVE-2026-44513: Hugging Face Diffusers — Remote Code Execution Risk (August 2026)

CVE-2026-44827, CVE-2026-45804, CVE-2026-44513 — Hugging Face Diffusers

Three high-severity vulnerabilities (CVE-2026-44827, CVE-2026-45804, CVE-2026-44513) in the Hugging Face Diffusers library permit attackers to execute arbitrary code by bypassing the trust_remote_code safeguard during model loading. These flaws, collectively tracked as FaceHugger, are not known to be exploited in the wild but present immediate risk for environments loading untrusted models. No CVSS score is published, but severity is rated high.

Attack Vector

Attackers exploit a time-of-check to time-of-use (TOCTOU) flaw in the Diffusers model loading process. By crafting malicious Hugging Face model repositories and leveraging custom pipelines, adversaries can bypass the intended trust_remote_code protection. When a vulnerable system loads such a model, arbitrary code embedded in the repository executes with the privileges of the process, potentially compromising CI/CD pipelines, production servers, and containerized environments. No specific IOCs are published; detection relies on monitoring unexpected code execution during model loading.

Who Is at Risk

All organizations using Hugging Face Diffusers prior to version 0.38.0 are exposed, especially those loading models or pipelines from untrusted or public repositories. Enterprises integrating Diffusers into automated ML workflows, CI/CD systems, or container images are at heightened risk. Hugging Face is the primary affected vendor.

Patch & Mitigate

• Patch: Upgrade Diffusers to version 0.38.0 or later immediately.
• Workaround: Avoid loading models or pipelines from untrusted repositories. Disable trust_remote_code where possible.
• Detect: Review logs for unexpected code execution events during model loading, especially when interacting with external or new repositories.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers gain access by delivering malicious model repositories to target environments.
• TA0005 — Defense Evasion: Exploitation bypasses trust_remote_code, circumventing built-in security controls.

Source: https://thehackernews.com/2026/08/hugging-face-diffusers-flaws-could-let.html