Skip to content
OpenAdvisories

Product · huggingface

diffusers

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 4.3
    CVE-2026-65920

    Diffusers Path Traversal via weight_map Arbitrary File Read

    Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _get_checkpoint_shard_files function that allows attackers to read arbitrary files by supplying malicious weight_map values in model index JSON. Attackers can us…

    huggingface diffusers