CVE-2026-45804

Awaiting Analysis Awaiting Analysis - Queue

Diffusion Pipeline Code Execution in Hugging Face Diffusers

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers' DiffusionPipeline.from_pretrained flow can bypass the trust_remote_code guard because download() validates model_index.json and custom pipeline code before later loading from a cached folder that can change, allowing a Hub repository with custom .py pipeline code to execute through the custom pipeline flow without passing custom_pipeline or trust_remote_code=True. This issue is fixed in version 0.38.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-15

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-45804

EUVD

EUVD-2026-44711

Affected Vendors & Products

Vendor	Product	Version / Range
huggingface	diffusers	0.38.0
huggingface	diffusers	to 0.38.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

Executive Summary

CVE-2026-45804 is a Time-of-Check Time-of-Use (TOCTOU) vulnerability in the Hugging Face Diffusers library affecting the DiffusionPipeline.from_pretrained function. It allows bypassing the trust_remote_code guard by exploiting a race condition between two HTTP calls (hf_hub_download and snapshot_download). An attacker can push malicious changes to a repository between these calls, leading to arbitrary code execution without proper validation.

Detection Guidance

This vulnerability involves a race condition in the Hugging Face Diffusers library where malicious code can be executed during model loading. Detection requires checking for unusual network activity or unexpected file modifications during model downloads. Monitor logs for repeated calls to DiffusionPipeline.from_pretrained with custom_pipeline parameters pointing to external repositories. Check for suspicious files like pipeline.py in cached model directories.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on your system when you load a model from the Hugging Face Hub. The attack requires no privileges or user interaction beyond calling DiffusionPipeline.from_pretrained. If exploited, it could lead to data theft, system compromise, or further network infiltration.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating GDPR's data protection requirements or HIPAA's security rules by allowing access to sensitive data. Organizations using affected versions may face compliance violations if exploited, as it undermines secure data handling practices required by these regulations.

Mitigation Strategies

Upgrade to Diffusers version 0.38.0 or later. Avoid using custom_pipeline with untrusted repositories. Pin repository revisions to specific commits when loading models. Set trust_remote_code=False explicitly and disable remote code execution via DIFFUSERS_DISABLE_REMOTE_CODE environment variable. Review cached model directories for unexpected files.

Hi! I’m here to help you understand CVE-2026-45804. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70