Skip to content
OpenAdvisories

Package · PyPI

diffusers

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 7.5
    CVE-2026-45804

    Diffusers: TOCTOU Trust Remote Code Bypass

    Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers' DiffusionPipeline.from_pretrained flow can bypass the trust_remote_code guard because download() validates model_index.json and custom pipeline code before later loading f…

    huggingface diffusers diffusers PyPI
  • High 8.8
    CVE-2026-44827

    Diffusers: None.py Trust Remote Code Bypass

    Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, diffusers 0.37.0 allows remote code execution without the trust_remote_code=True safeguard when loading pipelines from Hugging Face Hub repositories. The _resolve_custom_pipeline_and…

    huggingface diffusers diffusers PyPI
  • High 8.8
    CVE-2026-44513

    Diffusers: `trust_remote_code` bypass via `custom_pipeline` and local custom components

    Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, a trust_remote_code bypass in DiffusionPipeline.from_pretrained allows arbitrary remote code execution despite the user passing trust_remote_code=False (or omitting it, which is the …

    huggingface diffusers diffusers PyPI