CVE-2026-44827: Hugging Face Diffusers remote code execution via None.py bypass

CVE-2026-44827 · Severity: high · CVSS 8.8 · Published 2026-05-14

A vulnerability in the Hugging Face Diffusers library allows a malicious AI model repository to execute arbitrary code on a user's computer. This occurs silently when a user attempts to load a model using the standard 'from_pretrained' method, even if they have not explicitly enabled custom code execution. An attacker can use this to gain full control over the system running the model, potentially leading to data theft or persistent access.

Technologies: Hugging Face Diffusers, diffusers (PyPI). Vendors: Hugging Face, PyPI.

Quick answers

Is CVE-2026-44827 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44827 being exploited in the wild.
How severe is CVE-2026-44827?
High severity, with a CVSS score of 8.8, published 14 May 2026.
Which products and versions are affected?
Hugging Face Diffusers < 0.38.0, 0.37.0; diffusers (PyPI) ECOSYSTEM:introduced=0,fixed=0.38.0.
Is there a fix for CVE-2026-44827?
Yes. diffusers (PyPI): upgrade to 0.38.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44827 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44827?
Check whether you run Hugging Face Diffusers or diffusers (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • diffusers (PyPI): upgrade to 0.38.0 or later
    pip install "diffusers>=0.38.0"

Technical details

A remote code execution (RCE) vulnerability exists in the `DiffusionPipeline.from_pretrained` flow of the Diffusers library. The root cause is a string formatting error in `_resolve_custom_pipeline_and_cls` where a default `None` value for the `custom_pipeline` argument is interpolated into the filename `None.py`. Because the `trust_remote_code` security gate in `download()` only checks for non-null `custom_pipeline` values, a malicious repository containing a `None.py` file can bypass this check. When the pipeline is instantiated, it loads and executes the code within `None.py` from the local cache or remote repository without user consent. This allows for silent RCE when loading a specially crafted model from the Hugging Face Hub. The issue is fixed in version 0.38.0 by moving the security gate to a centralized bottleneck in the dynamic module loading utility.

Affected products

  • Hugging Face diffusers < 0.38.0

Identifiers

  • CVE-2026-44827
  • GHSA-j7w6-vpvq-j3gm
  • PYSEC-2026-41

Timeline

  • 2026-05-01: advisory: Initial GHSA publication
  • 2026-05-07: disclosed: CVE-2026-44827 assigned
  • 2026-05-07: patched: Fixed in version 0.38.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.