GHSA-j7w6-vpvq-j3gm: Duplicate Advisory: Diffusers has a `trust_remote_code` bypass via `custom_pipeline` and local custom components
- Identifier
- GHSA-j7w6-vpvq-j3gm
- Published
- Record updated
- Affected
- diffusers < 0.38.0
- Fixed in
- 0.38.0
- released May 1, 2026, 6 days before disclosure (ecosystem taken from the tracked package of that name)
Summary
This advisory was withdrawn as a duplicate of GHSA-98h9-4798-4q5v and is kept to preserve external references. The original description reports that DiffusionPipeline.from_pretrained in Diffusers can load arbitrary code through the custom_pipeline flow from a Hub repo, or when _class_name in model_index.json names a custom class, without trust_remote_code being passed. The source describes the call succeeding and returning a functional pipeline.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Affected packages in the Exposure Registry
Matched by package name. An entry matched by name alone may be a different package of the same name in another ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- diffusersPyPILLM dependency since 2022-05-30 · 20 tracked dependents
Related items
- MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSame vendor · NVD/CVE Database
- HighCVE-2026-119120: Crawl4AI Docker API lets clients choose the HuggingFace model it loadsSame vendor · NVD/CVE Database
- HighGHSA-wf6j-7hvr-gr93: Hydra legacy target blacklist permits unsafe PyYAML loadingSame vendor · Hugging Face Security Advisories
- MediumCVE-2026-100653: vLLM unpinned Hugging Face artifact loads for FunAudioChat and Tarsier2Same vendor · NVD/CVE Database
- HighGHSA-3hmm-rh5q-gwwr: LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loadingSame vendor · Hugging Face Security Advisories