Quick answers
- Is CVE-2026-65920 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-65920 being exploited in the wild.
- How severe is CVE-2026-65920?
- Medium severity, with a CVSS score of 4.3, published 23 July 2026.
- Which products and versions are affected?
- Hugging Face Diffusers <= 0.39.0.
- Is there a fix for CVE-2026-65920?
- A patch was published on 2026-07-17: Fix merged into main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-65920 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-65920?
- Check whether you run Hugging Face Diffusers at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A path traversal vulnerability exists in the `_get_checkpoint_shard_files` function within `src/diffusers/utils/hub_utils.py`. The library fails to sanitize shard filenames retrieved from the `weight_map` in a model's index JSON file (`diffusion_pytorch_model.safetensors.index.json`). An attacker can provide a malicious model containing `../` sequences or absolute paths in the `weight_map` values. When a user loads this model using functions like `DiffusionPipeline.from_pretrained`, the library will join these malicious paths with the model directory, allowing the attacker to read arbitrary files (in safetensors format) from the host system. The issue was fixed in commit `cee298c` by validating that shard filenames do not contain directory traversal components.
Affected products
- Hugging Face Diffusers <= 0.39.0
Timeline
- 2026-06-09: disclosed: Initial report to Hugging Face
- 2026-07-12: other: Public GitHub issue opened
- 2026-07-17: patched: Fix merged into main branch
- 2026-07-23: advisory: CVE published