Diffusers Fixes Three Remote Code Execution Flaws
Hugging Face's Diffusers 0.38.0 fixes three vulnerabilities, as reported on July 28, that could let malicious model repositories execute arbitrary code during pipeline loading even when trust_remote_code was disabled. The flaws involved custom pipelines, local snapshots, a default None.py path, and a separate time-of-check, time-of-use issue.
Hugging Face's Diffusers 0.38.0 fixes three vulnerabilities in DiffusionPipeline.from_pretrained() that could allow a malicious model repository to execute arbitrary code despite the library's trust_remote_code safeguard. Infosecurity Magazine reported on July 28 that the flaws affect vulnerable loading flows and can silently run code from crafted repositories.
The issues are tracked as CVE-2026-44513, CVE-2026-44827, and CVE-2026-45804. NVD describes CVE-2026-44513 as a trust-gate bypass in versions before 0.38.0, with a CVSS 3.1 vector indicating network reachability, low attack complexity, no required privileges, user interaction, and high impact to confidentiality, integrity, and availability.
The guard did not sit at the load boundary
According to NVD's description of CVE-2026-44513, the underlying defect was that the trust_remote_code check was implemented in DiffusionPipeline.download() rather than at the dynamic-module loading site. Consequently, code paths that skipped or short-circuited download() could bypass the check.
NVD lists three variants under CVE-2026-44513:
- •A caller could load a trusted-looking primary repository while passing an attacker-controlled repository through custom_pipeline; the check evaluated the primary repository's files while loading pipeline.py from the second repository.
- •A local snapshot combined with an attacker-controlled custom_pipeline could skip the download() path entirely and load remote code.
- •A local snapshot containing custom component files referenced in model_index.json could also execute those component files because the local-path flow skipped the guard.
CVE-2026-44827 covers a separate default-value path in Diffusers 0.37.0. NVD reports that _resolve_custom_pipeline_and_cls interpolated an unspecified custom_pipeline value into the filename None.py. An attacker-controlled Hub repository containing None.py and a suitable pipeline class could therefore cause execution during a standard from_pretrained() call without a custom_pipeline argument or trust_remote_code=True. Infosecurity Magazine reports a CVSS score of 8.8 for this issue.
Race between validation and loading
CVE-2026-45804 is a time-of-check, time-of-use issue. BaseFortify's report, which identifies GitHub as the CVE assigner, states that Diffusers validated model_index.json and custom pipeline code before subsequently loading from a cached folder that could change. It describes an attack in which malicious code is introduced between the relevant Hub download operations, allowing the custom-pipeline flow to execute code without custom_pipeline or trust_remote_code=True.
BaseFortify lists a CVSS 3.1 base score of 7.5 for CVE-2026-45804 and identifies CWE-367, the standard category for time-of-check, time-of-use race conditions. It also states that the issue is fixed in 0.38.0.
For ML platform teams, the defects are a reminder that model repositories can contain executable Python as well as weights and configuration. In comparable supply-chain incidents, a boolean consent flag offers limited protection when validation occurs at a different layer or time from the eventual import. Pinning Diffusers to 0.38.0 or later and isolating model-loading jobs reduce exposure to repository-side code paths described in the advisories.
Infosecurity Magazine reports that Diffusers receives roughly seven million downloads monthly, placing the issue in software used across production AI pipelines, CI/CD systems, and container images. The reported vulnerability conditions require a victim to load a malicious or modified repository.
Key Points
- 1Diffusers 0.38.0 closes three code-execution paths where trust_remote_code=False did not reliably prevent Python imports from model repositories.
- 2The flaws expose a supply-chain boundary: model-loading APIs may process executable repository files, not only weights and configuration metadata.
- 3Comparable security failures show that validation must occur at the actual import boundary and remain consistent across local, cached, and remote paths.
Scoring Rationale
These are high-severity remote code execution flaws in a widely used diffusion-model library and affect model-loading flows. The patched issues are especially relevant to ML engineers operating production AI pipelines, CI/CD systems, and container images.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
