CVE-2026-45804 – huggingface diffusers

This update addresses multiple vulnerabilities in huggingface diffusers prior to version 0.38.0. CVE-2026-44827 has a CVSS score of 8.8, High severity. A verified public proof of concept (PoC) demonstrates that an attacker can achieve remote code execution by abusing the trust_remote_code safeguard during DiffusionPipeline.from_pretrained() through a malicious None.py file in a Hugging Face Hub repository. CVE-2026-45804 has a CVSS score of 7.5, High severity. A verified PoC shows that changes to cached pipeline content can bypass the trust_remote_code validation, allowing custom pipeline code to execute without requiring trust_remote_code=True. CVE-2026-44513 has a CVSS score of 8.8, High severity. It allows multiple trust_remote_code bypass scenarios that can lead to arbitrary remote code execution, although no verified public exploitation has been reported.

These vulnerabilities share a common root cause: security validation was performed during the download process instead of at the point where dynamic Python modules were loaded. As a result, attackers could craft malicious model repositories or exploit alternate loading paths to execute arbitrary code despite the intended trust_remote_code protection. Version 0.38.0 corrects these issues by closing the affected code paths. Two of the vulnerabilities have Remote Code Execution (RCE) characteristics, while one has Elevation of Privilege (EoP) characteristics.