High-Risk RCE Flaw CVE-2026-4372 Found in Hugging Face Transformers

Langflow is an open-source, low-code AI workflow platform that can connect large language models with CSV data to build agents. Its CSV Agent hard-codes allow_dangerous_code as True, automatically enabling LangChain's Python REPL. If the service is exposed to the internet, a malicious prompt can execute Python and operating-system commands, putting data, keys and control of the host at risk.

GitHub disclosed CVE-2026-27966 on February 26, 2026. It carries a CVSS 3.1 score of 9.8 and affects all versions before 1.8.0; Langflow patched it in version 1.8.0. Separately, the vulnerability that Sysdig detected being exploited on March 18, about 20 hours after disclosure, was CVE-2026-33017. Six IP addresses attempted attacks within two days, and the patched version for that flaw is 1.9.0.

Hugging Face’s Diffusers is a widely used open-source library for loading and running diffusion-based generative AI models. Its security matters because developers frequently pull model repositories created by third parties. The trust_remote_code control is designed to restrict custom code shipped with those repositories, making any bypass a potential software-supply-chain threat to individual workstations and corporate AI infrastructure.

Cybersecurity firm Zafran disclosed FaceHugger, a race-condition vulnerability that could let an attacker publish a malicious AI model repository and circumvent trust_remote_code while the model is being loaded. Successful exploitation could result in arbitrary code execution on the user’s computer. Hugging Face has fixed the vulnerability in Diffusers version 0.38.0, and users should upgrade promptly and review the provenance of downloaded models.