CVE-2026-45804: Hugging Face Diffusers remote code execution via trust_remote_code bypass

CVE-2026-45804 · Severity: high · CVSS 7.5 · Published 2026-07-15

Hugging Face Diffusers is a popular library used for running AI diffusion models. A security flaw allowed the library to download and execute untrusted code from third-party repositories even when users explicitly disabled the 'trust_remote_code' safety setting. This could allow an attacker to gain full control over a user's system if the user is tricked into loading a malicious model or pipeline configuration.

Technologies: Hugging Face Diffusers, diffusers (PyPI). Vendors: Hugging Face, PyPI.

Quick answers

Is CVE-2026-45804 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45804 being exploited in the wild.
How severe is CVE-2026-45804?
High severity, with a CVSS score of 7.5, published 15 July 2026.
Which products and versions are affected?
Hugging Face Diffusers < 0.38.0; diffusers (PyPI) ECOSYSTEM:introduced=0,fixed=0.38.0.
Is there a fix for CVE-2026-45804?
Yes. diffusers (PyPI): upgrade to 0.38.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45804 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-45804?
Check whether you run Hugging Face Diffusers or diffusers (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • diffusers (PyPI): upgrade to 0.38.0 or later
    pip install "diffusers>=0.38.0"

Technical details

A Time-of-Check Time-of-Use (TOCTOU) vulnerability exists in the Diffusers library's 'DiffusionPipeline.from_pretrained' method. The 'trust_remote_code' guard was only enforced on the primary model repository, failing to validate external repositories specified via the 'custom_pipeline' parameter. An attacker can host a malicious 'pipeline.py' in a separate repository; when a user attempts to load a benign model while referencing the malicious custom pipeline, the library executes the remote code regardless of the 'trust_remote_code=False' setting. This occurs because the download process validates the local 'model_index.json' before loading from a cached folder that can be manipulated or bypassed during the custom pipeline flow. The issue is fixed in version 0.38.0 by ensuring the trust check covers all remote code sources.

Affected products

  • huggingface diffusers < 0.38.0

Identifiers

  • CVE-2026-45804
  • GHSA-7wx4-6vff-v64p
  • PYSEC-2026-2446

Timeline

  • 2026-04-12: disclosed: Issue reported on GitHub
  • 2026-04-23: patched: Fix merged into main branch
  • 2026-07-15: advisory: CVE-2026-45804 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.