FaceHugger: Hugging Face Diffusers Flaws Open Door to AI Supply Chain Attacks
Resources
Company
Free Trial
Get a Demo
Resources
Company
Free Trial
Get a Demo
Resources<br>Blog<br>Blog<br>Blog<br>FaceHugger: Vulnerabilities in Hugging Face Diffusers Open Door to Supply Chain Attacks on Enterprise AI
FaceHugger: Vulnerabilities in Hugging Face Diffusers Open Door to Supply Chain Attacks on Enterprise AI<br>Zafran Labs discovered that malicious AI model repositories can run arbitrary code on any machine that loads it, slipping past the control meant to stop exactly that. The diffusers library sees ~200,000 installs a day.
Author:<br>Gal Zaban<br>Ido Shani
Published on<br>July 27, 2026
Blog
Executive Summary<br>Zafran Labs discovered a set of high-severity vulnerabilities in Hugging Face's diffusers library that let a malicious model repository silently execute arbitrary code on any client machine that loads it. These vulnerabilities are bypassing trust_remote_code, the safeguard designed to stop unreviewed code from running in the custom pipelines loading process.<br>Hugging Face has become a critical part of the AI software supply chain, rapidly evolving to be the "GitHub of the AI era". Its libraries and repositories are widely integrated into development, research, and production environments.<br>Because diffusers runs inside production pipelines, CI/CD systems, and container images, a single compromised load can hand an attacker initial access deep inside an enterprise environment rather than to an isolated user application.<br>The likelihood of exploitation is elevated by both reach and mechanics. The library draws roughly 7 million downloads per month, close to 200,000 installations per day, and Hugging Face overall handles more than 100 million monthly downloads, normalized across enterprise environments through partnerships with Microsoft, Amazon Bedrock, NVIDIA, and Apple.<br>Hugging Face's July 2026 security incident showed the risk of treating AI repository content as trusted data. According to Hugging Face, a malicious dataset abused two code-execution paths in its data-processing pipeline to run code on a worker; the actor then escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters. OpenAI later attributed the intrusion to its own models, including GPT-5.6 Sol and a more capable pre-release model, whose safeguards it says were intentionally reduced for an evaluation, calling the event an unprecedented cyber incident.<br>Hugging Face found no evidence that public models, datasets, spaces, published packages, or container images were modified. But the incident and our research point to the same weakness. Where that breach exploited the dataset pipeline, our vulnerabilities target the model-loading path, and a comparable attacker could turn a routine model download into code execution across a large share of Hugging Face's user base, private developers and enterprises alike.<br>Every variant in our blog and research traced to one root cause: a classic Time-of-Check to Time-of-Use (TOCTOU) flaw. A model download that should be a single atomic operation was split into two sequential, non-atomic HTTP requests, and the security gate that enforces trust_remote_code runs only against the first. The underlying problem is that artifacts pulled from AI repositories are frequently treated as passive data, when configuration files, loaders, and custom pipeline code can quietly cross into executable code and turn a routine model load into an initial-access vector.<br>The findings comprise CVE-2026-44827 (CVSS 8.8), a code-injection flaw, CVE-2026-45804 (CVSS 7.5), a race condition, and three related variants tracked under CVE-2026-44513 (CVSS 8.8). Full technical analysis, exploitation detail, and the disclosure timeline follow below.<br>This connects directly to Zafran's broader research across the AI ecosystem proving that these massive codebases share common security risks. These findings continue Project DarkSide , Zafran Labs' research into how quickly-adopted AI infrastructure re-introduces long-standing classes of software vulnerabilities. ChainLeak research, where we found two critical vulnerabilities in the Chainlit AI framework that exposed cloud API keys and enabled cloud takeover, and DifyTap research, where we showed how attackers could silently wiretap AI data across tenants on the Dify platform.<br>Background<br>Overview & Enterprise Adoption<br>Hugging Face has rapidly evolved into the "GitHub of the AI era," serving as a foundational dependency for the global generative AI ecosystem with over 100 million monthly downloads. Within this landscape, the diffusers library has become the default standard for loading and running diffusion models for image, video, and audio generation. The library’s reach is substantial, with over 30K GitHub stars, and approximately 7 million monthly downloads, translating to nearly 200,000 installations per day.<br>Hugging Face has become the...