CVE-2026-45804
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A vulnerability in the Diffusers library before version 0.38.0 allows bypassing the trust_remote_code guard. The download() method validates model_index.json and custom pipeline code but later loads from a cached folder that can change, enabling execution of malicious .py code from a Hub repository without requiring trust_remote_code=True.
Risk Assessment
The organization may unknowingly execute malicious code from a Hub repository, leading to remote code execution (RCE) and potential system compromise or data breach.
Recommendation
Immediately update the Diffusers library to version 0.38.0 or later. Until updated, avoid using pipelines from untrusted Hub repositories.
Other vulnerabilities in Diffusers
See all- CVE-2026-65920Medium
A path traversal vulnerability was found in Diffusers up to version 0.39.0 in the _get_checkpoint_shard_files function. Attackers can supply malicious weight_map values in model index JSON, containing ../ sequences or absolute paths, allowing reading of safetensors files outside the intended directory.
- CVE-2026-44513High
The Diffusers library before version 0.38.0 contains a vulnerability that bypasses the trust_remote_code protection. An attacker can execute arbitrary remote code even when trust_remote_code is set to False or omitted. The issue stems from a flawed implementation of the security check in the download() function, which can be bypassed through alternative code paths.
Original NVD description (English source)
Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers' DiffusionPipeline.from_pretrained flow can bypass the trust_remote_code guard because download() validates model_index.json and custom pipeline code before later loading from a cached folder that can change, allowing a Hub repository with custom .py pipeline code to execute through the custom pipeline flow without passing custom_pipeline or trust_remote_code=True. This issue is fixed in version 0.38.0.