# CVE-2026-45804: Hugging Face Diffusers remote code execution via trust_remote_code bypass

Source: https://junglewise.ai/threats/cve-2026-45804-hugging-face-diffusers-remote-code-execution-via-trust-remote  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-45804 · Severity: high · CVSS 7.5 · Published 2026-07-15

Hugging Face Diffusers is a popular library used for running AI diffusion models. A security flaw allowed the library to download and execute untrusted code from third-party repositories even when users explicitly disabled the 'trust_remote_code' safety setting. This could allow an attacker to gain full control over a user's system if the user is tricked into loading a malicious model or pipeline configuration.

Technologies: [Hugging Face Diffusers](https://junglewise.ai/threats/technologies/diffusers), [diffusers (PyPI)](https://junglewise.ai/threats/technologies/pypi-diffusers). Vendors: [Hugging Face](https://junglewise.ai/threats/vendors/hugging-face), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-45804 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45804 being exploited in the wild.

**How severe is CVE-2026-45804?** High severity, with a CVSS score of 7.5, published 15 July 2026.

**Which products and versions are affected?** Hugging Face Diffusers < 0.38.0; diffusers (PyPI) ECOSYSTEM:introduced=0,fixed=0.38.0.

**Is there a fix for CVE-2026-45804?** Yes. diffusers (PyPI): upgrade to 0.38.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45804 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-45804?** Check whether you run Hugging Face Diffusers or diffusers (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- diffusers (PyPI): upgrade to 0.38.0 or later

  ```sh
  pip install "diffusers>=0.38.0"
  ```


## Technical details

A Time-of-Check Time-of-Use (TOCTOU) vulnerability exists in the Diffusers library's 'DiffusionPipeline.from_pretrained' method. The 'trust_remote_code' guard was only enforced on the primary model repository, failing to validate external repositories specified via the 'custom_pipeline' parameter. An attacker can host a malicious 'pipeline.py' in a separate repository; when a user attempts to load a benign model while referencing the malicious custom pipeline, the library executes the remote code regardless of the 'trust_remote_code=False' setting. This occurs because the download process validates the local 'model_index.json' before loading from a cached folder that can be manipulated or bypassed during the custom pipeline flow. The issue is fixed in version 0.38.0 by ensuring the trust check covers all remote code sources.

## Affected products

- huggingface diffusers < 0.38.0

## Identifiers

- CVE-2026-45804
- GHSA-7wx4-6vff-v64p
- PYSEC-2026-2446

## Timeline

- 2026-04-12: disclosed: Issue reported on GitHub
- 2026-04-23: patched: Fix merged into main branch
- 2026-07-15: advisory: CVE-2026-45804 published

## References

- [https://github.com/huggingface/diffusers/commit/a37f6f8394ac2a7ee8360c3abea811efe54512b1](https://github.com/huggingface/diffusers/commit/a37f6f8394ac2a7ee8360c3abea811efe54512b1)
- [https://github.com/huggingface/diffusers/issues/13446](https://github.com/huggingface/diffusers/issues/13446)
- [https://github.com/huggingface/diffusers/pull/13448](https://github.com/huggingface/diffusers/pull/13448)
- [https://github.com/huggingface/diffusers/releases/tag/v0.38.0](https://github.com/huggingface/diffusers/releases/tag/v0.38.0)
- [https://github.com/huggingface/diffusers/security/advisories/GHSA-7wx4-6vff-v64p](https://github.com/huggingface/diffusers/security/advisories/GHSA-7wx4-6vff-v64p)

## Related threats

- [Hugging Face Diffusers path traversal in _get_checkpoint_shard_files](https://junglewise.ai/threats/cve-2026-65920-hugging-face-diffusers-path-traversal-in-get-checkpoint-shard)
- [Hugging Face Diffusers remote code execution via None.py bypass](https://junglewise.ai/threats/cve-2026-44827-hugging-face-diffusers-remote-code-execution-via-none-py-bypass)
- [Hugging Face Diffusers remote code execution in DiffusionPipeline](https://junglewise.ai/threats/cve-2026-44513-hugging-face-diffusers-remote-code-execution-in-diffusionpipeline)