CVE-2026-44513
CVSS 8.8 HIGH: diffusers is the a library for pretrained diffusion models. EPSS 0.9% (58th percentile).
Vulnerabilities · 56 days ago
Diffusers treats a model repository as data until load time, and these flaws let that boundary fail. A repo a team meant to inspect can still cross into executable code during model loading, so the normal trust model for AI artifacts breaks inside pipelines, CI jobs, and containers.
Zafran reported three high-severity CVEs in Hugging Face diffusers that bypass trust_remote_code, and Hugging Face fixed them in diffusers 0.38.0. The issue affects vulnerable versions of a library with roughly seven million downloads a month, including production AI systems that pull third-party models.
The practical risk is not limited to one bad model file. If model loading can invoke attacker-controlled code, the repository itself becomes part of the software supply chain, and patching the library is only useful if teams also verify what they load and where they load it.
CVSS 8.8 HIGH: diffusers is the a library for pretrained diffusion models. EPSS 0.9% (58th percentile).
CVSS 8.8 HIGH: diffusers is the a library for pretrained diffusion models. EPSS 0.7% (51st percentile).
CVSS 7.5 HIGH: diffusers is the a library for pretrained diffusion models. EPSS 0.4% (28th percentile).
2 sources covering this story
Hugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Code
Three Hugging Face Diffusers flaws bypass trust_remote_code, letting crafted model repositories execute code during custom pipeline loading.
Bugs in Hugging Face Diffusers Bypass Custom Code Safeguard
Three CVEs in Hugging Face diffusers let a malicious model repo run code on any machine that loads it
Part of the PlainSec briefing for 2026-08-03