Executive brief
A vulnerability in the Hugging Face Diffusers library allows a malicious AI model repository to execute arbitrary code on a user's computer. This occurs silently when a user attempts to load a model using the standard 'from_pretrained' method, even if they have not explicitly enabled custom code execution. An attacker can use this to gain full control over the system running the model, potentially leading to data theft or persistent access.
Technical details
A remote code execution (RCE) vulnerability exists in the `DiffusionPipeline.from_pretrained` flow of the Diffusers library. The root cause is a string formatting error in `_resolve_custom_pipeline_and_cls` where a default `None` value for the `custom_pipeline` argument is interpolated into the filename `None.py`. Because the `trust_remote_code` security gate in `download()` only checks for non-null `custom_pipeline` values, a malicious repository containing a `None.py` file can bypass this check. When the pipeline is instantiated, it loads and executes the code within `None.py` from the local cache or remote repository without user consent. This allows for silent RCE when loading a specially crafted model from the Hugging Face Hub. The issue is fixed in version 0.38.0 by moving the security gate to a centralized bottleneck in the dynamic module loading utility.
Affected products
- Hugging Face diffusers < 0.38.0
Timeline
- 2026-05-01: advisory: Initial GHSA publication
- 2026-05-07: disclosed: CVE-2026-44827 assigned
- 2026-05-07: patched: Fixed in version 0.38.0
References
- https://github.com/huggingface/diffusers/security/advisories/GHSA-j7w6-vpvq-j3gm
- https://github.com/huggingface/diffusers/pull/13448
- https://github.com/huggingface/diffusers/commit/a37f6f8394ac2a7ee8360c3abea811efe54512b1
- https://github.com/huggingface/diffusers/releases/tag/v0.38.0
- https://github.com/pypa/advisory-database/tree/main/vulns/diffusers/PYSEC-2026-41.yaml