Hugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Code

Three high-severity vulnerabilities in Hugging Face's Diffusers library, collectively named FaceHugger, allow attackers to bypass the trust_remote_code safeguard and execute arbitrary code when loading models from untrusted repositories. The flaws stem from TOCTOU race conditions and improper validation during model loading, enabling malicious model repositories to silently run code during pipeline initialization. These vulnerabilities affect systems that use DiffusionPipeline.from_pretrained with untrusted or remote custom pipelines, posing significant AI supply chain risks.

AI-extracted · verify before operational use