Security researchers at Zafran have disclosed three race-condition vulnerabilities in the Hugging Face Diffusers library — one of the most widely used Python libraries for loading and running AI image-generation models. The flaws exploit a time-of-check to time-of-use (TOCTOU) weakness in how Diffusers downloads and validates model files: the library’s trust_remote_code security gate, which controls whether custom Python code hosted inside a model repository can execute, runs only against the first of two sequential HTTP requests used to download a model. By swapping in malicious code between those two requests, or by structuring a model repository so custom code is invisible to the first-phase check, an attacker-controlled model repository can bypass the gate entirely and run arbitrary code on the machine loading it. The attack turns a routine DiffusionPipeline.from_pretrained() call — the standard way developers and enterprises load AI models from Hugging Face — into an initial-access vector.
The Diffusers library has over 100 million downloads in recent months. Enterprise environments that pull AI models from Hugging Face into CI/CD pipelines, container images, or production inference servers are at risk because model files are frequently treated as passive data rather than potentially executable code. The three vulnerabilities — tracked under GitHub Security Advisories GHSA-j7w6-vpvq-j3gm, GHSA-7wx4-6vff-v64p, and GHSA-98h9-4798-4q5v — were fixed in Diffusers version 0.38.0, released in early May 2026. If immediate patching is not possible, the Diffusers project recommends only loading models from trusted repositories and explicitly setting trust_remote_code=False.
How to check if you’re affected
Affected versions are Diffusers releases prior to 0.38.0. Any codebase that calls DiffusionPipeline.from_pretrained() with custom pipelines and loads models from external or community Hugging Face repositories is affected. Run pip show diffusers to check your installed version. Upgrade to 0.38.0 or later to receive the fix. If your environment cannot be patched immediately, set trust_remote_code=False in all from_pretrained() calls and audit your model sources to confirm you are only loading from repositories you control or have explicitly vetted.