VulnSocial

CVE-2026-44513Active Exploitation(huggingface / diffusers)

MEDIUMCVSS 8.8 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch huggingface diffusers systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, a trust_remote_code bypass in DiffusionPipeline.from_pretrained allows arbitrary remote code execution despite the user passing trust_remote_code=False (or omitting it, which is the default). The vulnerability has three variants, all sharing the same root cause — the trust_remote_code gate was implemented inside DiffusionPipeline.download() rather than at the actual dynamic-module load site, so any code path that bypassed or short-circuited download() also bypassed the security check. DiffusionPipeline.from_pretrained('repoA', custom_pipeline='attacker/repoB', trust_remote_code=False) — the gate evaluated against repoA's file list rather than repoB's, so repoB's pipeline.py was loaded and executed. DiffusionPipeline.from_pretrained('/local/snapshot', custom_pipeline='attacker/repoB', trust_remote_code=False) — the local-path branch never invoked download(), so the gate was never reached and remote code from repoB executed. DiffusionPipeline.from_pretrained('/local/snapshot', trust_remote_code=False) where the snapshot contains custom component files (e.g. unet/my_unet_model.py) referenced from model_index.json — same root cause; the local path skipped download() and custom component code executed. This vulnerability is fixed in 0.38.0.

huggingface CVEsBack to dashboard
5.5/ 10 priority

Sources & remediation

Exploit / PoC references
Other references
Weakness type (CWE)
CWE-94CWE-358

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • diffusers

Threat summary

  • Active exploitation appears in 1 classified signals
  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 2 mentions across 2 observed days

What's happening

  • Active exploitation reported across 1 signal
  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Peaked 1d ago at 1 mentions (2026-08-03); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
huggingface
Products
diffusers

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-08-03: 1Mentions · 2026-08-10: 1PoC Mentioned / Linked · 2026-08-10: 1Active Exploitation · 2026-08-03: 1Patch / Workaround · 2026-08-10: 1Technical Details · 2026-08-03: 1Technical Details · 2026-08-10: 108-0308-10
Signal classification2 categories
Active Exploitation
150.0%
PoC
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-08-031
Active Exploitation1
2026-08-101
PoC1
Full discourse2 posts
  • S2W_DailyThreat@S2W_DailyThreat
    PoC

    [VULNERABILITY] HuggingFace Diffusers: CVE-2026-44513, CVE-2026-44827, CVE-2026-45804 flaws run untrusted pipeline code. Target Version: Versions before 0.38.0 In May 2026, three arbitrary code execution vulnerabilities (CVE-2026-44513, CVE-2026-44827, CVE-2026-45804) were disclosed in the DiffusionPipeline.from_pretrained load flow. All three bypass the trust_remote_code safeguard, allowing untrusted Python code from a repository to execute with the user's process privileges. All three are rated HIGH (CVSS 3.1: 8.8, 8.8, and 7.5, respectively) and were fixed in 0.38.0. ✔ CVE-2026-44827 carries the highest exploitability, triggering on a default model load with no extra arguments, and has a public PoC. CVE-2026-45804 exploits a narrow ~0.3s TOCTOU race, making exploitation difficult. No in-the-wild use is confirmed; detailed analyses are public for the other two. 📌 S2W Advisory: Update Diffusers to 0.38.0 or later. If updating is not possible, load only trusted, audited Hub repositories and local snapshots, and check the repository root and component directories for unexpected .py files, including http://None.py. Do not point custom_pipeline at a different Hub repository, and pin the revision to a commit hash before loading. Follow @S2W_DailyThreat #Vulnerability #ArbitraryCodeExecution #Diffusers #AISecurity #S2W

    Post summary

    Three high‑severity arbitrary code execution flaws were disclosed in HuggingFace Diffusers with a public PoC for the most exploitable CVE; patches and mitigations are available but no in‑the‑wild exploitation is reported.

    00000290
    244 followersView on X
  • Aviatrix Threat Research Center@aviatrixtrc
    Active Exploitation

    TRC analysis shows attackers exploited vulnerabilities in Hugging Face's Diffusers library (CVE-2026-44827, CVE-2026-44513) to execute arbitrary code during AI model loading, bypassing trust_remote_code safeguards. This highlights risks when AI infrastructure lacks proper runtime segmentation. #AIecurity #ZeroTrust 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/hugging-face-diffusers-flaws-cve-2026-44827

    Post summary

    The analysis confirms attackers exploited CVE‑2026‑44827 and CVE‑2026‑44513 in Hugging Face’s Diffusers library to execute arbitrary code during model loading, underscoring the risk of insufficient runtime segmentation.

    0000068
    1.9K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Apphuggingfacediffusers-python-

Explore more

Back to dashboardhuggingface CVEsdiffusers vulnerabilities