Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers' DiffusionPipeline.from_pretrained flow can bypass the trust_remote_code guard because download() validates model_index.json and custom pipeline code before later loading from a cached folder that can change, allowing a Hub repository with custom .py pipeline code to execute through the custom pipeline flow without passing custom_pipeline or trust_remote_code=True. This issue is fixed in version 0.38.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-20 | 1 | Patch1 |
| 2026-08-04 | 1 | Patch1 |
| 2026-08-10 | 1 | Disclosure1 |
Hugging FaceのDiffusersライブラリに遠隔コード実行の脆弱性。悪意あるモデルをロードすると任意のコードを実行させられるものTOCTOU脆弱性で、CVE-2026-44827、CVE-2026-45804、CVE-2026-44513の3件。バージョン0.38.0以降で修正。 https://cybersecuritynews.com/hugging-face-diffusers-vulnerabilities/
Post summary
The text announces three CVEs affecting Hugging Face Diffusers that allow remote code execution via a TOCTOU flaw and notes that the issue is fixed in version 0.38.0 and newer.
[VULNERABILITY] HuggingFace Diffusers: CVE-2026-44513, CVE-2026-44827, CVE-2026-45804 flaws run untrusted pipeline code. Target Version: Versions before 0.38.0 In May 2026, three arbitrary code execution vulnerabilities (CVE-2026-44513, CVE-2026-44827, CVE-2026-45804) were disclosed in the DiffusionPipeline.from_pretrained load flow. All three bypass the trust_remote_code safeguard, allowing untrusted Python code from a repository to execute with the user's process privileges. All three are rated HIGH (CVSS 3.1: 8.8, 8.8, and 7.5, respectively) and were fixed in 0.38.0. ✔ CVE-2026-44827 carries the highest exploitability, triggering on a default model load with no extra arguments, and has a public PoC. CVE-2026-45804 exploits a narrow ~0.3s TOCTOU race, making exploitation difficult. No in-the-wild use is confirmed; detailed analyses are public for the other two. 📌 S2W Advisory: Update Diffusers to 0.38.0 or later. If updating is not possible, load only trusted, audited Hub repositories and local snapshots, and check the repository root and component directories for unexpected .py files, including http://None.py. Do not point custom_pipeline at a different Hub repository, and pin the revision to a commit hash before loading. Follow @S2W_DailyThreat #Vulnerability #ArbitraryCodeExecution #Diffusers #AISecurity #S2W
Post summary
The post announces three arbitrary code execution CVEs in HuggingFace Diffusers, provides technical details and patch guidance, notes a public PoC for CVE-2026-44827, and confirms no known active exploitation.
⚠️ Linux Red Hat AI Inference Server alert: CVE-2026-45804 (CVSS 7.5) Remote attackers could execute arbitrary code. Upgrade to a vendor-listed fixed release. https://vulnipulse.com/advisories/linux-cve-2026-45804 #Linux #RedHatAIInferenceServer #RCE #CyberSecurity #CVE
Post summary
An advisory for CVE-2026-45804 warns that remote attackers could execute arbitrary code on Red Hat AI Inference Server. Users are advised to upgrade to the vendor’s fixed release to mitigate the vulnerability.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | huggingface | diffusers | - | python | - |