Diffusers CVEs: trust_remote_code was never a real gate

If you pull models from Hugging Face, you have been relying on a flag called trust_remote_code=False to stop a stranger's repository from running code on your machine. Three CVEs disclosed this week show that flag could be walked around. A model download is a code execution path, and the safety switch you assumed was closing it wasn't always closing it.

What actually happened

Researchers at Zafran Labs disclosed three vulnerabilities in Hugging Face's Diffusers library — the standard Python package for running diffusion models — reported by The Hacker News on August 3:

• CVE-2026-44827 (CVSS 8.8) — code injection through the custom_pipeline flow using a crafted pipeline named None.py, executing despite trust_remote_code=False.
• CVE-2026-44513 (CVSS 8.8) — a second code injection path through custom_pipeline that likewise bypasses the trust check.
• CVE-2026-45804 (CVSS 7.5) — a race condition. An attacker modifies the repository configuration between the hf_hub_download and snapshot_download HTTP calls, so what you validated is not what you load.

The common root is a time-of-check-to-time-of-use gap: the trust gate ran during initial validation, not at the moment the dynamic module was loaded. Infosecurity Magazine's writeup notes all three affect versions before 0.38.0, where Hugging Face moved enforcement closer to the module-loading point and tightened validation across remote, cached, and local sources.

Worth naming plainly: 0.38.0 shipped in May 2026. The fix has been available for months. The disclosure is what tells you whether you actually took it.

Why AI supply chain security matters for your business

Most teams treat pip install as the dependency boundary and stop there. But an AI feature has a second supply chain — the model artifacts — and it gets far less scrutiny. Nobody Dependabots a Hugging Face repo ID.

That second chain has the same properties as npm. A model repo is a remote artifact controlled by someone else, mutable after you first fetched it, and loaded by code with your service account's permissions. We've watched this play out already with compromised npm packages targeting AI assistant keys and with an autonomous agent walking through Hugging Face. Same lesson, different registry.

Four things to do this week if you run diffusion models anywhere in production:

1. Upgrade Diffusers to 0.38.0 or later. pip index versions diffusers and check what's actually installed in your image, not what's in your requirements file.
2. Pin model revisions to a commit SHA, not a branch name. revision="a1b2c3d" is the difference between fetching what you reviewed and fetching what the repo owner pushed last night.
3. Run model loading in a container with no cloud credentials. If arbitrary code does execute, it should land somewhere with nothing worth stealing.
4. Inventory which model repos you load and who owns them. If you can't answer that in five minutes, that's the finding.

Sources: The Hacker News, Infosecurity Magazine.