CVE-2026-44513: Hugging Face Diffusers remote code execution in DiffusionPipeline

CVE-2026-44513 · Severity: high · CVSS 8.8 · Published 2026-05-14

Hugging Face Diffusers is a popular library used for generating images and audio with AI models. A security flaw allowed the library to execute malicious code from untrusted sources even when users explicitly configured it not to trust remote code. An attacker could exploit this by tricking a user into loading a malicious AI model or pipeline, leading to full control over the user's computer.

Technologies: Hugging Face Diffusers, diffusers (PyPI). Vendors: Hugging Face, PyPI.

Quick answers

Is CVE-2026-44513 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44513 being exploited in the wild.
How severe is CVE-2026-44513?
High severity, with a CVSS score of 8.8, published 14 May 2026.
Which products and versions are affected?
Hugging Face Diffusers < 0.38.0; diffusers (PyPI) ECOSYSTEM:introduced=0,fixed=0.38.0.
Is there a fix for CVE-2026-44513?
Yes. diffusers (PyPI): upgrade to 0.38.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44513 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44513?
Check whether you run Hugging Face Diffusers or diffusers (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • diffusers (PyPI): upgrade to 0.38.0 or later
    pip install "diffusers>=0.38.0"

Technical details

A code injection vulnerability exists in the `DiffusionPipeline.from_pretrained` method of the Diffusers library. The `trust_remote_code` security gate was incorrectly implemented within the `download()` function rather than at the module loading site. This allowed three bypass variants: cross-repository custom pipelines where the check targeted the wrong repo, and two local snapshot scenarios where the `download()` function was skipped entirely, allowing execution of `pipeline.py` or custom component files (e.g., `unet/my_unet_model.py`). Attackers can achieve silent remote code execution if a user loads a crafted model or pipeline. The issue is resolved in version 0.38.0 by moving the security check to the `get_cached_module_file` chokepoint.

Affected products

  • Hugging Face diffusers < 0.38.0

Identifiers

  • CVE-2026-44513
  • GHSA-98h9-4798-4q5v
  • PYSEC-2026-40

Timeline

  • 2026-05-01: disclosed: Initial disclosure in repository
  • 2026-05-07: advisory: GitHub Advisory published
  • 2026-05-14: other: NVD published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.