# CVE-2026-44513: Hugging Face Diffusers remote code execution in DiffusionPipeline

Source: https://junglewise.ai/threats/cve-2026-44513-hugging-face-diffusers-remote-code-execution-in-diffusionpipeline  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-14. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-44513 · Severity: high · CVSS 8.8 · Published 2026-05-14

Hugging Face Diffusers is a popular library used for generating images and audio with AI models. A security flaw allowed the library to execute malicious code from untrusted sources even when users explicitly configured it not to trust remote code. An attacker could exploit this by tricking a user into loading a malicious AI model or pipeline, leading to full control over the user's computer.

Technologies: [Hugging Face Diffusers](https://junglewise.ai/threats/technologies/diffusers), [diffusers (PyPI)](https://junglewise.ai/threats/technologies/pypi-diffusers). Vendors: [Hugging Face](https://junglewise.ai/threats/vendors/hugging-face), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-44513 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44513 being exploited in the wild.

**How severe is CVE-2026-44513?** High severity, with a CVSS score of 8.8, published 14 May 2026.

**Which products and versions are affected?** Hugging Face Diffusers < 0.38.0; diffusers (PyPI) ECOSYSTEM:introduced=0,fixed=0.38.0.

**Is there a fix for CVE-2026-44513?** Yes. diffusers (PyPI): upgrade to 0.38.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44513 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44513?** Check whether you run Hugging Face Diffusers or diffusers (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- diffusers (PyPI): upgrade to 0.38.0 or later

  ```sh
  pip install "diffusers>=0.38.0"
  ```


## Technical details

A code injection vulnerability exists in the `DiffusionPipeline.from_pretrained` method of the Diffusers library. The `trust_remote_code` security gate was incorrectly implemented within the `download()` function rather than at the module loading site. This allowed three bypass variants: cross-repository custom pipelines where the check targeted the wrong repo, and two local snapshot scenarios where the `download()` function was skipped entirely, allowing execution of `pipeline.py` or custom component files (e.g., `unet/my_unet_model.py`). Attackers can achieve silent remote code execution if a user loads a crafted model or pipeline. The issue is resolved in version 0.38.0 by moving the security check to the `get_cached_module_file` chokepoint.

## Affected products

- Hugging Face diffusers < 0.38.0

## Identifiers

- CVE-2026-44513
- GHSA-98h9-4798-4q5v
- PYSEC-2026-40

## Timeline

- 2026-05-01: disclosed: Initial disclosure in repository
- 2026-05-07: advisory: GitHub Advisory published
- 2026-05-14: other: NVD published

## References

- [https://api.github.com/users/hlky](https://api.github.com/users/hlky)
- [https://github.com/hlky](https://github.com/hlky)
- [https://api.github.com/users/hlky/gists%7B/gist_id%7D](https://api.github.com/users/hlky/gists%7B/gist_id%7D)
- [https://api.github.com/users/hlky/repos](https://api.github.com/users/hlky/repos)
- [https://avatars.githubusercontent.com/u/106811348?v=4](https://avatars.githubusercontent.com/u/106811348?v=4)
- [https://api.github.com/users/hlky/events%7B/privacy%7D](https://api.github.com/users/hlky/events%7B/privacy%7D)

## Related threats

- [Hugging Face Diffusers path traversal in _get_checkpoint_shard_files](https://junglewise.ai/threats/cve-2026-65920-hugging-face-diffusers-path-traversal-in-get-checkpoint-shard)
- [Hugging Face Diffusers remote code execution via trust_remote_code bypass](https://junglewise.ai/threats/cve-2026-45804-hugging-face-diffusers-remote-code-execution-via-trust-remote)
- [Hugging Face Diffusers remote code execution via None.py bypass](https://junglewise.ai/threats/cve-2026-44827-hugging-face-diffusers-remote-code-execution-via-none-py-bypass)