Hugging Face Diffusers Fixes Three Remote-Code Bypasses

CVE-2026-44827, scored 8.8, used a filename-resolution quirk: when no custom pipeline was supplied, a downstream path could resolve the missing value to None.py and load that file from a malicious repository. CVE-2026-45804, scored 7.5, was a time-of-check/time-of-use race between separate requests that inspected repository configuration and downloaded the final snapshot. A repository update between those requests could make the checked content differ from the code ultimately loaded.

CVE-2026-44513, also scored 8.8, covered three related paths in which the trust check was placed in the download step rather than at the point where dynamic Python modules were imported. Those paths included cross-repository custom pipelines and local snapshots containing or referencing custom components.

The advisories describe successful exploitation as silent arbitrary code execution in the process loading the model. They require a user or automated system to load an attacker-controlled repository or component; the disclosures do not establish that the flaws were exploited in the wild.

Hugging Face published Diffusers 0.38.0 on May 1. The advisories say the fix moves the trust_remote_code enforcement to the dynamic-module loading chokepoint so it applies wherever custom Python code is actually imported. Zafran's later July 27 report brought the three related issues together and framed them as an AI supply-chain risk.

Teams that load community models should upgrade to Diffusers 0.38.0 or later and audit any code paths that accept repository identifiers, custom_pipeline values, or local model snapshots from outside a trusted release process. Hugging Face's workarounds include reviewing unexpected Python files and avoiding unaudited cross-repository custom pipelines, but its advisory says those steps are mitigations rather than a complete fix. Pinning a repository revision can close the specific race window in CVE-2026-45804, yet it does not replace the patched loader for the other bypasses.

For ML platform owners, the broader control is to treat model repositories as software dependencies: restrict who can select them, record immutable revisions, scan downloaded snapshots, isolate model-loading jobs, and avoid exposing long-lived credentials to processes that import third-party model code.