HUGGING Face disclosed that flaws in its Diffusers library allow malicious model repositories to execute arbitrary code when loaded, putting AI pipelines at risk of supply chain compromise. The vulnerabilities were reported by Zafran Security and patched in May 2026, but the public reminder highlights the ongoing danger of trusting unverified models in enterprise workflows.
Researchers identified three high‑severity issues in the Diffusers code base, each arising from a timing gap between signature verification and the actual model loading routine. This window lets a specially crafted repository bypass security checks and run code during initialization. Although no CVE identifiers have been assigned yet, Zafran rated each flaw as high severity based on the potential impact.
The Diffusers library is a core component of many machine‑learning pipelines, meaning any application that pulls models from untrusted sources could be compromised simply by loading a tainted file. Successful exploitation gives the attacker the same privileges as the process executing the Diffusers code, enabling further lateral movement or data theft.
As of the latest advisories there is no evidence of active exploitation in the wild and no threat actor has been linked to the bugs. Nevertheless, the disclosure underscores the risk of supply chain attacks that target AI components, especially as organisations increasingly rely on community‑hosted models for production workloads.
Hugging Face has issued a patch that closes the timing window and enforces stricter validation before any model code is executed. Users should upgrade to the latest version of Diffusers immediately and review their model repositories for any unsigned or suspicious entries.
Beyond applying the update, security teams should enforce provenance checks such as requiring signed model artefacts and maintaining an internal whitelist of trusted repositories. Monitoring system logs for unexpected process spawns during model load can also help detect any attempted abuse.
Finally, organisations should treat machine‑learning libraries as part of their attack surface, applying the same patch management and code‑review rigor used for traditional software dependencies. This reduces the chance that a compromised model leads to broader system compromise.