GHSA-7wx4-6vff-v64p: Diffusers: TOCTOU Trust Remote Code Bypass

Summary

The `diffusers` package's `DiffusionPipeline.from_pretrained` flow contains a time-of-check/time-of-use flaw in its `trust_remote_code` guard. The guard reads `model_index.json` through `hf_hub_download` from one Hub commit, then `snapshot_download` fetches the files, and these two independent calls can resolve to different commits if the repository changes between them. Because the custom pipeline `.py` file is then imported from the newer snapshot, a custom-code load can run without `trust_remote_code=True`, allowing arbitrary code execution.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• diffusersPyPILLM dependency since 2022-05-30 · 20 tracked dependents

Related items

• MediumCVE-2026-100653: vLLM unpinned Hugging Face artifact loads for FunAudioChat and Tarsier2Same vendor · NVD/CVE Database
• HighGHSA-3hmm-rh5q-gwwr: LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loadingSame vendor · Hugging Face Security Advisories
• MediumCVE-2026-80047: Hugging Face Transformers writes remote Python files to disk before trust checkSame vendor · NVD/CVE Database
• HighCVE-2026-58474: whichllm code injection in run and snippet commands via GGUF filenamesSame vendor · NVD/CVE Database
• HighCVE-2026-79784: Vocos class instantiation from configuration via from_pretrainedSame vendor · NVD/CVE Database