Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Hugging Face diffusers trust_remote_code bypass (multiple vulnerabilities)

Vulnerability
First reported
Last updated
Happening score
H score 22
2 unique sources, 2 articles

Summary

Hide ▲

Hugging Face Diffusers flaws in the FaceHugger set let crafted model repositories bypass trust_remote_code and load arbitrary code during model loading. The disclosure covers CVE-2026-44827, CVE-2026-45804, and CVE-2026-44513, with one path abusing the `None.py` pipeline-name edge case and another exploiting a TOCTOU race between hf_hub_download and snapshot_download. Diffusers 0.38.0 was released on May 1 to close the identified variants. The affected loading path includes DiffusionPipeline.from_pretrained with custom pipelines, so AI pipelines, CI/CD systems, and container images that pull from Hugging Face repositories can be exposed if they load untrusted content.

Related Happenings

SNOWLIGHT-to-VShell remote-access backdoor chain

Malware Activity
H score51 First: 10.07.2026 14:30 Last: 10.07.2026 14:30 Sources 1

About this happening: The SNOWLIGHT dropper was used to install VShell, giving operators covert remote access on compromised hosts and hiding the backdoor as [kworker/0:2] in process li...

Open Happening

EtherRAT remote access trojan with blockchain-based C2

Malware Activity
H score31 First: 09.12.2025 19:15 Last: 09.12.2025 19:15 Sources 1

About this happening: EtherRAT is now a live Linux RAT threat because it combines Ethereum smart contracts for C2 with multiple persistence layers, making blocked infrastructure less effect...

Open Happening

Timeline

  1. 27.07.2026 03:00 3 articles · 15d ago

    Zafran publishes analysis of three diffusers flaws that execute arbitrary code

    Technical Analysis Update

    Zafran Security published its analysis on July 27, describing three high-severity Hugging Face diffusers flaws, including CVE-2026-44827, CVE-2026-45804, and CVE-2026-44513, and explaining how the separated trust check and code load let crafted repository content become executable code.

    Show sources
    Open in new tab
  2. 01.05.2026 03:00 1 articles · 3mo ago

    Hugging Face ships diffusers 0.38.0 to close trust_remote_code bypasses

    Mitigation Patch Update

    Hugging Face released diffusers 0.38.0 on May 1 and moved the security checks to the dynamic-module loading step, closing the identified trust_remote_code bypass variants in the affected library.

    Show sources
    Open in new tab
  3. 19.03.2026 02:00 1 articles · 4mo ago

    Zafran reports trust_remote_code bypass flaws in Hugging Face diffusers

    Initial Disclosure

    Zafran Security reported the first two flaws in vulnerable Hugging Face diffusers versions on March 19, identifying a trust_remote_code bypass that could let crafted model repositories silently execute arbitrary code during model loading.

    Show sources
    Open in new tab