Three high-severity security flaws have been disclosed in Hugging Face's Diffusers library, allowing crafted model repositories to stealthily execute arbitrary code on machines that load them, posing a risk to the artificial intelligence supply chain. The vulnerabilities, collectively named FaceHugger, bypass `trust_remote_code`, a safeguard designed to stop unreviewed code from running during custom pipeline loading, according to Zafran Labs researchers Gal Zaban and Ido Shani. Diffusers, a Python package for state-of-the-art pretrained diffusion models, has been downloaded more than 8.1 million times in July 2026. The root cause of all remote code execution variants is that the trust check lives entirely in the first phase of a two-step, non-atomic model download process, creating a Time-of-Check to Time-of-Use issue. The flaws are: CVE-2026-44827 (CVSS score: 8.8), a code injection vulnerability allowing arbitrary code via a crafted pipeline named "None.py" despite `trust_remote_code=False`; CVE-2026-45804 (CVSS score: 7.5), a race condition allowing code introduction by modifying configuration between HTTP calls; and CVE-2026-44513 (CVSS score: 8.8), a code injection vulnerability allowing arbitrary code to be loaded.