'FaceHugger' flaws in Hugging Face Diffusers let model repos run arbitrary code

The FaceHugger disclosure highlights the persistent supply-chain risk in the open-model ecosystem. Three high-severity flaws in Hugging Face's widely used Diffusers library — the standard toolkit for running image and diffusion models — could allow a maliciously crafted model repository to execute arbitrary code on any machine that loads it. Critically, the exploit bypasses the trust_remote_code safeguard, the very mechanism meant to protect users from running untrusted code embedded in downloaded models.

The mechanism matters because it inverts the usual trust model: developers routinely pull models from Hugging Face assuming that loading weights is safe, but these flaws mean a poisoned repository could compromise the host during a seemingly innocuous model load. That's especially dangerous given how casually developers download and experiment with community models.

The timing lands the disclosure squarely in a week defined by AI-security anxiety — the same day-range as the OpenAI–Hugging Face production breach revealed at Black Hat, though the two are distinct events (one is a library vulnerability, the other an autonomous-agent intrusion). Hugging Face's central role as the ecosystem's model registry makes it a high-value target on multiple fronts. The reassuring detail is that the flaws were already patched in Diffusers 0.38.0, released in early May 2026, so the practical risk is limited to users running outdated versions — a reminder that dependency hygiene is now a security requirement, not just maintenance. The broader lesson: as open-weight models proliferate (accelerated by this week's White House exemption), the attack surface of the model supply chain grows with them.