Arbitrary code execution in Hugging Face diffusers via trust_remote_code bypass (www.zafran.io)

Zafran Labs has identified critical vulnerabilities in Hugging Face's diffusers library, which allow malicious AI model repositories to execute arbitrary code on any machine that loads them, circumventing the trust_remote_code security mechanism designed to prevent unreviewed code from running. The diffusers library, which sees around 200,000 daily installations and is a cornerstone of the AI software supply chain, can turn a standard model download into a potential attack vector, raising significant security concerns for enterprises using Hugging Face's infrastructure. The vulnerabilities stem from a classic Time-of-Check to Time-of-Use (TOCTOU) flaw, where the security check against custom pipelines occurs at a different stage than the actual code execution, enabling attackers to exploit this gap. With Hugging Face acting as a central component in the AI ecosystem—managing over 100 million monthly downloads—these findings underscore a broader issue within rapidly adopted AI frameworks: the reintegration of longstanding security vulnerabilities. Hugging Face has yet to find evidence of exploitation but is under scrutiny to improve its safeguards to protect users and prevent similar exploitation in the future.