Executive brief
Hugging Face Diffusers is a popular library used for generating images and audio with AI models. A security flaw allowed the library to execute malicious code from untrusted sources even when users explicitly configured it not to trust remote code. An attacker could exploit this by tricking a user into loading a malicious AI model or pipeline, leading to full control over the user's computer.
Technical details
A code injection vulnerability exists in the `DiffusionPipeline.from_pretrained` method of the Diffusers library. The `trust_remote_code` security gate was incorrectly implemented within the `download()` function rather than at the module loading site. This allowed three bypass variants: cross-repository custom pipelines where the check targeted the wrong repo, and two local snapshot scenarios where the `download()` function was skipped entirely, allowing execution of `pipeline.py` or custom component files (e.g., `unet/my_unet_model.py`). Attackers can achieve silent remote code execution if a user loads a crafted model or pipeline. The issue is resolved in version 0.38.0 by moving the security check to the `get_cached_module_file` chokepoint.
Affected products
- Hugging Face diffusers < 0.38.0
Timeline
- 2026-05-01: disclosed: Initial disclosure in repository
- 2026-05-07: advisory: GitHub Advisory published
- 2026-05-14: other: NVD published