Article: CVE-2026-44827 lets an attacker execute arbitrary code when a Hugging Face Diffusers model is loaded, even if the trust_remote_code flag is turned off. Researchers named the flaw “FaceHugger” and traced it to a race condition in the library’s two-phase model loading process. Any pipeline that pulls models from the hub can be affected.

Why the vulnerability matters

Diffusers powers text-to-image and other diffusion models. In July 2026 it logged 8.1 million downloads, so countless CI/CD jobs, container images and enterprise inference services depend on it. The bug defeats the primary safety mechanism (trust_remote_code) that developers enable to block untrusted Python code shipped with a model.

How the bypass works

  • Two-phase loading: Diffusers first fetch a model configuration, then a second request pulls the model weights and any associated code.
  • Race condition: The security check that inspects the first request does not extend to the second one.
  • Payload insertion: An attacker who controls the second request injects malicious code that the library later executes, bypassing the trust gate entirely.

Because the check only looks at the initial request, disabling trust_remote_code gives a false sense of protection.

Immediate steps for developers

  1. Pin the Diffusers version in requirements.txt or your lock file to stop accidental upgrades to a vulnerable release.
  2. Avoid on-the-fly model pulls in production. Download models to a trusted artifact store (e.g., an internal S3 bucket) and load them from there.
  3. Audit model repositories before use. Verify that the model’s code files match expected hashes or come from a vetted source.
  4. Enforce network egress controls so build agents and inference servers cannot reach the public Hugging Face hub unless you allow it.
  5. Run model loading inside isolated containers or sandboxes with minimal privileges, limiting the impact of stray code execution.

Takeaway:

The FaceHugger bug shows that turning off trust_remote_code is not enough. Until you update Diffusers and harden your model ingestion pipeline, every remote model pull remains a potential entry point for malicious code.