Executive brief
Hugging Face Diffusers is a popular library used for running AI diffusion models. A security flaw allowed the library to download and execute untrusted code from third-party repositories even when users explicitly disabled the 'trust_remote_code' safety setting. This could allow an attacker to gain full control over a user's system if the user is tricked into loading a malicious model or pipeline configuration.
Technical details
A Time-of-Check Time-of-Use (TOCTOU) vulnerability exists in the Diffusers library's 'DiffusionPipeline.from_pretrained' method. The 'trust_remote_code' guard was only enforced on the primary model repository, failing to validate external repositories specified via the 'custom_pipeline' parameter. An attacker can host a malicious 'pipeline.py' in a separate repository; when a user attempts to load a benign model while referencing the malicious custom pipeline, the library executes the remote code regardless of the 'trust_remote_code=False' setting. This occurs because the download process validates the local 'model_index.json' before loading from a cached folder that can be manipulated or bypassed during the custom pipeline flow. The issue is fixed in version 0.38.0 by ensuring the trust check covers all remote code sources.
Affected products
- huggingface diffusers < 0.38.0
Timeline
- 2026-04-12: disclosed: Issue reported on GitHub
- 2026-04-23: patched: Fix merged into main branch
- 2026-07-15: advisory: CVE-2026-45804 published
References
- https://github.com/huggingface/diffusers/commit/a37f6f8394ac2a7ee8360c3abea811efe54512b1
- https://github.com/huggingface/diffusers/issues/13446
- https://github.com/huggingface/diffusers/pull/13448
- https://github.com/huggingface/diffusers/releases/tag/v0.38.0
- https://github.com/huggingface/diffusers/security/advisories/GHSA-7wx4-6vff-v64p