https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 21:09:42 +0000 https://cve.radiocsirt.org/vuln/cve-2026-44827 <p><strong>Affected:</strong> huggingface diffusers</p> <p>Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, diffusers 0.37.0 allows remote code execution without the trust_remote_code=True safeguard when loading pipelines from Hugging Face Hub repositories. The _resolve_custom_pipeline_and_cls function in pipeline_loading_utils.py performs string interpolation on the custom_pipeline parameter using f&#34;{custom_pipeline}.py&#34;. When custom_pipeline is not supplied by the user, it defaults to None, which Python interpolates as the literal string &#34;None.py&#34;. If an attacker publishes a Hub repository containing a file named None.py with a class that subclasses DiffusionPipeline, the file is automatically downloaded and executed during a standard DiffusionPipeline.from_pretrained() call with no additional keyword arguments. The trust_remote_code check in DiffusionPipeline.download() is bypassed because it evaluates custom_pipeline is not None as False (since the kwarg was never supplied), while the downstream code path that actually loads the module resolves the None value into a valid filename. An attacker can achieve silent arbitrary code execution by publishing a malicious model repository with a None.py file and a standard-looking model_index.json that references a legitimate pipeline class name, requiring only that a victim calls from_pretrained on the repository. This vulnerability is fixed in 0.38.0.</p> <p><strong>Affected:</strong> huggingface diffusers</p> <p>Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, diffusers 0.37.0 allows remote code execution without the trust_remote_code=True safeguard when loading pipelines from Hugging Face Hub repositories. The _resolve_custom_pipeline_and_cls function in pipeline_loading_utils.py performs string interpolation on the custom_pipeline parameter using f&#34;{custom_pipeline}.py&#34;. When custom_pipeline is not supplied by the user, it defaults to None, which Python interpolates as the literal string &#34;None.py&#34;. If an attacker publishes a Hub repository containing a file named None.py with a class that subclasses DiffusionPipeline, the file is automatically downloaded and executed during a standard DiffusionPipeline.from_pretrained() call with no additional keyword arguments. The trust_remote_code check in DiffusionPipeline.download() is bypassed because it evaluates custom_pipeline is not None as False (since the kwarg was never supplied), while the downstream code path that actually loads the module resolves the None value into a valid filename. An attacker can achieve silent arbitrary code execution by publishing a malicious model repository with a None.py file and a standard-looking model_index.json that references a legitimate pipeline class name, requiring only that a victim calls from_pretrained on the repository. This vulnerability is fixed in 0.38.0.</p> https://cve.radiocsirt.org/vuln/cve-2026-44827 https://cve.radiocsirt.org/vuln/ghsa-j7w6-vpvq-j3gm <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> PyPI: diffusers</p> <p>## Background</p> <p>This vulnerability is found in the `DiffusionPipeline.from_pretrained` flow, which is used to load a pipeline from the HuggingFace Hub.</p> <p>This function accepts an optional `custom_pipeline` keyword argument: the name of a Python file in the repo that contains a custom class inheriting from `DiffusionPipeline`. An equivalent flow is triggered when the `_class_name` field in `model_index.json` (the repo config file) is set to a custom class.</p> <p>Any attempt to use a custom pipeline throws the following exception, requesting that `trust_remote_code` is also passed:</p> <p>```python DiffusionPipeline.from_pretrained( pretrained_model_name_or_path=&#39;ido-shani/custom-pipeline&#39;, custom_pipeline=&#34;custom&#34; )</p> <p>ValueError: The repository for ido-shani/custom-pipeline contains custom code in custom.py which must be executed to correctly load the model. You can inspect the repository content at https://hf.co/ido-shani/custom-pipeline/blob/main/custom.py. Please pass the argument `trust_remote_code=True` to allow custom code to be run. ```</p> <p>The vulnerability is a silent RCE - it allows arbitrary code to be loaded through the custom\_pipeline flow from a Hub repo, with no `custom_pipeline` or `trust_remote_code` kwargs and nothing suspicious in the config. The `from_pretrained` call succeeds and returns a functional pipeline.</p> <p>## Naive Flow</p> <p>First, all relevant arguments are popped from kwargs and stored in local variables.</p> <p>Given a `pretrained_model_name_or_path` that is a Hub…</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> PyPI: diffusers</p> <p>## Background</p> <p>This vulnerability is found in the `DiffusionPipeline.from_pretrained` flow, which is used to load a pipeline from the HuggingFace Hub.</p> <p>This function accepts an optional `custom_pipeline` keyword argument: the name of a Python file in the repo that contains a custom class inheriting from `DiffusionPipeline`. An equivalent flow is triggered when the `_class_name` field in `model_index.json` (the repo config file) is set to a custom class.</p> <p>Any attempt to use a custom pipeline throws the following exception, requesting that `trust_remote_code` is also passed:</p> <p>```python DiffusionPipeline.from_pretrained( pretrained_model_name_or_path=&#39;ido-shani/custom-pipeline&#39;, custom_pipeline=&#34;custom&#34; )</p> <p>ValueError: The repository for ido-shani/custom-pipeline contains custom code in custom.py which must be executed to correctly load the model. You can inspect the repository content at https://hf.co/ido-shani/custom-pipeline/blob/main/custom.py. Please pass the argument `trust_remote_code=True` to allow custom code to be run. ```</p> <p>The vulnerability is a silent RCE - it allows arbitrary code to be loaded through the custom\_pipeline flow from a Hub repo, with no `custom_pipeline` or `trust_remote_code` kwargs and nothing suspicious in the config. The `from_pretrained` call succeeds and returns a functional pipeline.</p> <p>## Naive Flow</p> <p>First, all relevant arguments are popped from kwargs and stored in local variables.</p> <p>Given a `pretrained_model_name_or_path` that is a Hub…</p> https://cve.radiocsirt.org/vuln/ghsa-j7w6-vpvq-j3gm