Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, a trust_remote_code bypass in DiffusionPipeline.from_pretrained allows arbitrary remote code execution despite the user passing trust_remote_code=False (or omitting it, which is the default). The vulnerability has three variants, all sharing the same root cause — the trust_remote_code gate was implemented inside DiffusionPipeline.download() rather than at the actual dynamic-module load site, so any code path that bypassed or short-circuited download() also bypassed the security check. DiffusionPipeline.from_pretrained('repoA', custom_pipeline='attacker/repoB', trust_remote_code=False) — the gate evaluated against repoA's file list rather than repoB's, so repoB's pipeline.py was loaded and executed. DiffusionPipeline.from_pretrained('/local/snapshot', custom_pipeline='attacker/repoB', trust_remote_code=False) — the local-path branch never invoked download(), so the gate was never reached and remote code from repoB executed. DiffusionPipeline.from_pretrained('/local/snapshot', trust_remote_code=False) where the snapshot contains custom component files (e.g. unet/my_unet_model.py) referenced from model_index.json — same root cause; the local path skipped download() and custom component code executed. This vulnerability is fixed in 0.38.0.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-08-03 | 1 | Active Exploitation1 |
| 2026-08-10 | 1 | PoC1 |
| 2026-09-18 | 1 | Disclosure1 |
CVE-2026-44513: Hugging Face Diffusers trust_remote_code Bypass — What It Means for Your Business and How to Respond https://hubs.li/Q04xVR7C0
Post summary
The tweet announces CVE-2026-44513, describing a trust_remote_code bypass in Hugging Face Diffusers and linking to further information, but offers no PoC, exploit code, active exploitation evidence, or specific patch details.
[VULNERABILITY] HuggingFace Diffusers: CVE-2026-44513, CVE-2026-44827, CVE-2026-45804 flaws run untrusted pipeline code. Target Version: Versions before 0.38.0 In May 2026, three arbitrary code execution vulnerabilities (CVE-2026-44513, CVE-2026-44827, CVE-2026-45804) were disclosed in the DiffusionPipeline.from_pretrained load flow. All three bypass the trust_remote_code safeguard, allowing untrusted Python code from a repository to execute with the user's process privileges. All three are rated HIGH (CVSS 3.1: 8.8, 8.8, and 7.5, respectively) and were fixed in 0.38.0. ✔ CVE-2026-44827 carries the highest exploitability, triggering on a default model load with no extra arguments, and has a public PoC. CVE-2026-45804 exploits a narrow ~0.3s TOCTOU race, making exploitation difficult. No in-the-wild use is confirmed; detailed analyses are public for the other two. 📌 S2W Advisory: Update Diffusers to 0.38.0 or later. If updating is not possible, load only trusted, audited Hub repositories and local snapshots, and check the repository root and component directories for unexpected .py files, including http://None.py. Do not point custom_pipeline at a different Hub repository, and pin the revision to a commit hash before loading. Follow @S2W_DailyThreat #Vulnerability #ArbitraryCodeExecution #Diffusers #AISecurity #S2W
Post summary
Three high‑severity arbitrary code execution flaws were disclosed in HuggingFace Diffusers with a public PoC for the most exploitable CVE; patches and mitigations are available but no in‑the‑wild exploitation is reported.
TRC analysis shows attackers exploited vulnerabilities in Hugging Face's Diffusers library (CVE-2026-44827, CVE-2026-44513) to execute arbitrary code during AI model loading, bypassing trust_remote_code safeguards. This highlights risks when AI infrastructure lacks proper runtime segmentation. #AIecurity #ZeroTrust 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/hugging-face-diffusers-flaws-cve-2026-44827
Post summary
The analysis confirms attackers exploited CVE‑2026‑44827 and CVE‑2026‑44513 in Hugging Face’s Diffusers library to execute arbitrary code during model loading, underscoring the risk of insufficient runtime segmentation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | huggingface | diffusers | - | python | - |