Skip to content
AI Sec Watch
HighVulnerability

GHSA-98h9-4798-4q5v: Diffusers has a `trust_remote_code` bypass via `custom_pipeline` and local custom components

Source
Hugging Face Security Advisories(opens in a new tab)
Identifiers
CVE-2026-44513GHSA-98h9-4798-4q5v
Published
Record updated
View JSON
Affected
  • diffusers < 0.38.0
Fixed in
0.38.0
  • released May 1, 2026, 6 days before disclosure
Known exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS
1.1%

Summary

Diffusers versions before 0.38.0 let `DiffusionPipeline.from_pretrained` execute remote code even when `trust_remote_code=False` or omitted. The `trust_remote_code` gate sat inside `DiffusionPipeline.download()`, so cross-repo `custom_pipeline` values and local snapshots, which skip `download()`, loaded and ran attacker-supplied `pipeline.py` or custom component files silently on the victim's machine. Anyone calling `from_pretrained` with custom pipelines is affected.

Mitigation

Fixed in diffusers 0.38.0 via PR #13448, which moves the gate into `get_cached_module_file` in `src/diffusers/utils/dynamic_modules_utils.py`. Upgrade with `pip install --upgrade "diffusers>=0.38.0"`. Interim workarounds: only load audited sources, do not pass a `custom_pipeline` pointing at a different Hub repo than `pretrained_model_name_or_path` before reading its `pipeline.py`, and inspect local snapshots for unexpected `*.py` files before calling `from_pretrained`. The source states these are mitigations, not fixes.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

  • diffusersPyPILLM dependency since 2022-05-30 · 20 tracked dependents

Related items