Hugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Code

Three high-severity security flaws have been disclosed in Hugging Face's Diffusers library that could allow crafted model repositories to stealthily execute arbitrary code on machines that load it, opening the artificial intelligence (AI) supply chain to security risk. "These vulnerabilities are bypassing trust_remote_code, the safeguard designed to stop unreviewed code from running in the

The article reports three high‑severity CVEs in Hugging Face’s Diffusers library that allow a malicious model repository to bypass the trust_remote_code safeguard and execute arbitrary code when clients load pipelines via DiffusionPipeline.from_pretrained, even with trust_remote_code=False.[1][2][4][5] These flaws, rooted in misplaced trust checks and race conditions in the model download path, were fixed in Diffusers 0.38.0, but any deployment using earlier versions and custom pipelines is exposed to silent remote code execution from the AI model supply chain.[1][2][3][4][5] From a RealGround perspective, these vulnerabilities turn routine model loading into a supply‑chain RCE vector, so organizations need SBOM‑level visibility into Diffusers versions and model sources, enforce allowlists and pinned revisions for Hugging Face repositories, and run AI workloads in sandboxed, least‑privilege environments.[4][5] RealGround services would focus on mapping and hardening the AI supply chain, assessing where Diffusers is used in production agents and pipelines, and updating build and runtime controls so untrusted or tampered model repositories cannot introduce arbitrary code execut