Diffusers Fixes Three Remote Code Execution Flaws
Hugging Face's Diffusers 0.38.0 fixes three vulnerabilities, as reported on July 28, that could let malicious model repositories execute arbitrary code during pipeline loading even when trust_remote_code was disabled. The flaws involved custom pipelines, local snapshots, a default None.py path, and a separate time-of-check, time-of-use issue.
Three Hugging Face Diffusers security advisories describe ways malicious model repositories could execute Python during DiffusionPipeline.from_pretrained() even when users did not enable trust_remote_code. The disclosures are CVE-2026-44513, CVE-2026-44827, and CVE-2026-45804, and each lists Diffusers 0.38.0 as the patched version. Infosecurity Magazine grouped the issues in a July 28 report.
The first two advisories carry CVSS 3.1 scores of 8.8, while the time-of-check, time-of-use issue carries a score of 7.5. The attack conditions differ, but each begins with a victim loading a malicious or modified model repository.
The guard did not sit at the load boundary
Hugging Face's advisory for CVE-2026-44513 says the trust_remote_code check sat in DiffusionPipeline.download() rather than at the dynamic-module loading site. Code paths that skipped or short-circuited download() could therefore bypass the check.
The advisory describes three variants:
- •A caller could load a trusted-looking primary repository while passing an attacker-controlled repository through custom_pipeline; the check evaluated the primary repository while loading pipeline.py from the second repository.
- •A local snapshot combined with an attacker-controlled custom_pipeline could skip the download() path and load remote code.
- •A local snapshot containing custom component files referenced in model_index.json could execute those files because the local-path flow also skipped the guard.
CVE-2026-44827 covers a separate default-value path in Diffusers 0.37.0. Its advisory says _resolve_custom_pipeline_and_cls interpolated an unspecified custom_pipeline value into the filename None.py. A malicious Hub repository containing None.py and a suitable pipeline class could then execute code during a standard from_pretrained() call without a custom_pipeline argument or trust_remote_code=True.
Race between validation and loading
CVE-2026-45804 is a time-of-check, time-of-use flaw. The vendor advisory says Diffusers validated model_index.json and custom pipeline code before later loading from a cached folder that could change. A repository could be modified between the relevant Hub download operations, allowing the custom-pipeline flow to execute code without custom_pipeline or trust_remote_code=True.
For ML platform teams, the defects show that model repositories can contain executable Python as well as weights and configuration. A consent flag offers limited protection when validation happens at a different layer or time from the eventual import. Upgrading to Diffusers 0.38.0 or later, restricting model sources, reviewing unexpected Python files, pinning repository revisions, and isolating model-loading jobs reduce exposure to the paths described in the advisories.
Infosecurity Magazine reports that Diffusers receives roughly seven million downloads monthly, placing the issue in software used across production AI pipelines, CI/CD systems, and container images.
Key Points
- 1Diffusers 0.38.0 patches three disclosed code-execution vulnerabilities in model-loading flows where the trust_remote_code safeguard could be bypassed.
- 2The flaws expose a supply-chain boundary: model-loading APIs may process executable repository files, not only weights and configuration metadata.
- 3Validation needs to occur at the actual import boundary and remain consistent across local, cached, and remote paths.
Scoring Rationale
These are high-severity remote code execution flaws in a widely used diffusion-model library and affect model-loading flows. The patched issues are especially relevant to ML engineers operating production AI pipelines, CI/CD systems, and container images.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
