Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, diffusers 0.37.0 allows remote code execution without the trust_remote_code=True safeguard when loading pipelines from Hugging Face Hub repositories. The _resolve_custom_pipeline_and_cls function in pipeline_loading_utils.py performs string interpolation on the custom_pipeline parameter using f"{custom_pipeline}.py". When custom_pipeline is not supplied by the user, it defaults to None, which Python interpolates as the literal string "None.py". If an attacker publishes a Hub repository containing a file named None.py with a class that subclasses DiffusionPipeline, the file is automatically downloaded and executed during a standard DiffusionPipeline.from_pretrained() call with no additional keyword arguments. The trust_remote_code check in DiffusionPipeline.download() is bypassed because it evaluates custom_pipeline is not None as False (since the kwarg was never supplied), while the downstream code path that actually loads the module resolves the None value into a valid filename. An attacker can achieve silent arbitrary code execution by publishing a malicious model repository with a None.py file and a standard-looking model_index.json that references a legitimate pipeline class name, requiring only that a victim calls from_pretrained on the repository. This vulnerability is fixed in 0.38.0.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-08-03 | 1 | Active Exploitation1 |
| 2026-08-04 | 1 | Patch1 |
| 2026-08-10 | 1 | Patch1 |
Hugging FaceのDiffusersライブラリに遠隔コード実行の脆弱性。悪意あるモデルをロードすると任意のコードを実行させられるものTOCTOU脆弱性で、CVE-2026-44827、CVE-2026-45804、CVE-2026-44513の3件。バージョン0.38.0以降で修正。 https://cybersecuritynews.com/hugging-face-diffusers-vulnerabilities/
Post summary
Hugging Face’s Diffusers library is affected by remote code execution TOCTOU vulnerabilities (CVE-2026-44827, CVE-2026-45804, CVE-2026-44513) and versions 0.38.0 and later include a fix.
[VULNERABILITY] HuggingFace Diffusers: CVE-2026-44513, CVE-2026-44827, CVE-2026-45804 flaws run untrusted pipeline code. Target Version: Versions before 0.38.0 In May 2026, three arbitrary code execution vulnerabilities (CVE-2026-44513, CVE-2026-44827, CVE-2026-45804) were disclosed in the DiffusionPipeline.from_pretrained load flow. All three bypass the trust_remote_code safeguard, allowing untrusted Python code from a repository to execute with the user's process privileges. All three are rated HIGH (CVSS 3.1: 8.8, 8.8, and 7.5, respectively) and were fixed in 0.38.0. ✔ CVE-2026-44827 carries the highest exploitability, triggering on a default model load with no extra arguments, and has a public PoC. CVE-2026-45804 exploits a narrow ~0.3s TOCTOU race, making exploitation difficult. No in-the-wild use is confirmed; detailed analyses are public for the other two. 📌 S2W Advisory: Update Diffusers to 0.38.0 or later. If updating is not possible, load only trusted, audited Hub repositories and local snapshots, and check the repository root and component directories for unexpected .py files, including http://None.py. Do not point custom_pipeline at a different Hub repository, and pin the revision to a commit hash before loading. Follow @S2W_DailyThreat #Vulnerability #ArbitraryCodeExecution #Diffusers #AISecurity #S2W
Post summary
Three arbitrary‑code‑execution flaws were disclosed in HuggingFace Diffusers, with prompts for updating to version 0.38.0 or applying practical mitigations; no in‑the‑wild exploitation has been observed.
TRC analysis shows attackers exploited vulnerabilities in Hugging Face's Diffusers library (CVE-2026-44827, CVE-2026-44513) to execute arbitrary code during AI model loading, bypassing trust_remote_code safeguards. This highlights risks when AI infrastructure lacks proper runtime segmentation. #AIecurity #ZeroTrust 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/hugging-face-diffusers-flaws-cve-2026-44827
Post summary
The report confirms that CVE‑2026‑44827 and CVE‑2026‑44513 were actively exploited to run arbitrary code when loading AI models, underscoring the need for runtime segmentation in Hugging Face Diffusers.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | huggingface | diffusers | - | python | - |