https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 20:33:50 +0000 https://cve.radiocsirt.org/vuln/cve-2026-45804 <p><strong>Affected:</strong> huggingface diffusers</p> <p>Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers&#39; DiffusionPipeline.from_pretrained flow can bypass the trust_remote_code guard because download() validates model_index.json and custom pipeline code before later loading from a cached folder that can change, allowing a Hub repository with custom .py pipeline code to execute through the custom pipeline flow without passing custom_pipeline or trust_remote_code=True. This issue is fixed in version 0.38.0.</p> <p><strong>Affected:</strong> huggingface diffusers</p> <p>Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers&#39; DiffusionPipeline.from_pretrained flow can bypass the trust_remote_code guard because download() validates model_index.json and custom pipeline code before later loading from a cached folder that can change, allowing a Hub repository with custom .py pipeline code to execute through the custom pipeline flow without passing custom_pipeline or trust_remote_code=True. This issue is fixed in version 0.38.0.</p> https://cve.radiocsirt.org/vuln/cve-2026-45804 https://cve.radiocsirt.org/vuln/ghsa-7wx4-6vff-v64p <p><strong>Affected:</strong> PyPI: diffusers</p> <p>## Background</p> <p>This vulnerability is found in the `diffusers` package - the `transformers`-equivalent library for diffusion models.</p> <p>It is found in the `DiffusionPipeline.from_pretrained` flow, which is used to load a pipeline from the HuggingFace Hub.</p> <p>This function has a `trust_remote_code` guard: if the repository’s `model_index.json` references a custom pipeline class defined in a `.py` file in the repo, the load is blocked unless `trust_remote_code=True` is explicitly passed:</p> <p>``` ValueError: The repository for attacker/repo contains custom code in pipeline.py which must be executed to correctly load the model. You can inspect the repository content at https://hf.co/attacker/repo/blob/main/pipeline.py. Please pass the argument `trust_remote_code=True` to allow custom code to be run. ```</p> <p>The vulnerability allows arbitrary code execution through the custom pipeline flow from a Hub repo, with no `custom_pipeline` or `trust_remote_code` kwargs passed. The `from_pretrained` call succeeds and returns a functional pipeline.</p> <p>---</p> <p>## Naive Flow</p> <p>`DiffusionPipeline.from_pretrained` begins by popping all relevant arguments from `kwargs` into local variables, then calls `DiffusionPipeline.download()` to fetch the repo files:</p> <p>```python # pipeline_utils.py:853 cached_folder = cls.download( pretrained_model_name_or_path, ... custom_pipeline=custom_pipeline, trust_remote_code=trust_remote_code, ... ) ```</p> <p>Inside `download()`, `model_index.json` is fetched first a…</p> <p><strong>Affected:</strong> PyPI: diffusers</p> <p>## Background</p> <p>This vulnerability is found in the `diffusers` package - the `transformers`-equivalent library for diffusion models.</p> <p>It is found in the `DiffusionPipeline.from_pretrained` flow, which is used to load a pipeline from the HuggingFace Hub.</p> <p>This function has a `trust_remote_code` guard: if the repository’s `model_index.json` references a custom pipeline class defined in a `.py` file in the repo, the load is blocked unless `trust_remote_code=True` is explicitly passed:</p> <p>``` ValueError: The repository for attacker/repo contains custom code in pipeline.py which must be executed to correctly load the model. You can inspect the repository content at https://hf.co/attacker/repo/blob/main/pipeline.py. Please pass the argument `trust_remote_code=True` to allow custom code to be run. ```</p> <p>The vulnerability allows arbitrary code execution through the custom pipeline flow from a Hub repo, with no `custom_pipeline` or `trust_remote_code` kwargs passed. The `from_pretrained` call succeeds and returns a functional pipeline.</p> <p>---</p> <p>## Naive Flow</p> <p>`DiffusionPipeline.from_pretrained` begins by popping all relevant arguments from `kwargs` into local variables, then calls `DiffusionPipeline.download()` to fetch the repo files:</p> <p>```python # pipeline_utils.py:853 cached_folder = cls.download( pretrained_model_name_or_path, ... custom_pipeline=custom_pipeline, trust_remote_code=trust_remote_code, ... ) ```</p> <p>Inside `download()`, `model_index.json` is fetched first a…</p> https://cve.radiocsirt.org/vuln/ghsa-7wx4-6vff-v64p