{"data":{"id":"167acf42-031b-4fdc-b98f-76828c36d559","title":"GHSA-98h9-4798-4q5v: Diffusers has a `trust_remote_code` bypass via `custom_pipeline` and local custom components","summary":"Diffusers versions before 0.38.0 let `DiffusionPipeline.from_pretrained` execute remote code even when `trust_remote_code=False` or omitted. The `trust_remote_code` gate sat inside `DiffusionPipeline.download()`, so cross-repo `custom_pipeline` values and local snapshots, which skip `download()`, loaded and ran attacker-supplied `pipeline.py` or custom component files silently on the victim's machine. Anyone calling `from_pretrained` with custom pipelines is affected.","solution":"Fixed in diffusers 0.38.0 via PR #13448, which moves the gate into `get_cached_module_file` in `src/diffusers/utils/dynamic_modules_utils.py`. Upgrade with `pip install --upgrade \"diffusers>=0.38.0\"`. Interim workarounds: only load audited sources, do not pass a `custom_pipeline` pointing at a different Hub repo than `pretrained_model_name_or_path` before reading its `pipeline.py`, and inspect local snapshots for unexpected `*.py` files before calling `from_pretrained`. The source states these are mitigations, not fixes.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-98h9-4798-4q5v","publishedAt":"2026-05-07T05:31:17.000Z","cveId":"CVE-2026-44513","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["diffusers@< 0.38.0 (fixed: 0.38.0)"],"affectedPackageNames":["diffusers"],"affectedPackageRefs":["pypi:diffusers"],"affectedVendors":["HuggingFace"],"affectedVendorsRaw":["Diffusers","HuggingFace"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.01071,"epssCheckedAt":"2026-11-11T00:13:29.486Z","kevDateAdded":null,"advisoryAliases":["GHSA-98h9-4798-4q5v"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-05-07T05:31:17.000Z","fixReleasedAt":"2026-05-01T05:42:12.779Z","daysToFix":-6,"fixCheckedAt":"2026-10-29T21:36:45.071Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability","safety"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"diffusers","fixedVersion":"0.38.0","matchedVersion":"0.38.0","fixReleasedAt":"2026-05-01T05:42:12.779Z","daysToFix":-6,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:36:44.925Z"}]}}