CVE-2026-44513
Full vulnerability record from the local CVENow database.
Description
Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, a trust_remote_code bypass in DiffusionPipeline.from_pretrained allows arbitrary remote code execution despite the user passing trust_remote_code=False (or omitting it, which is the default). The vulnerability has three variants, all sharing the same root cause — the trust_remote_code gate was implemented inside DiffusionPipeline.download() rather than at the actual dynamic-module load site, so any code path that bypassed or short-circuited download() also bypassed the security check. DiffusionPipeline.from_pretrained('repoA', custom_pipeline='attacker/repoB', trust_remote_code=False) — the gate evaluated against repoA's file list rather than repoB's, so repoB's pipeline.py was loaded and executed. DiffusionPipeline.from_pretrained('/local/snapshot', custom_pipeline='attacker/repoB', trust_remote_code=False) — the local-path branch never invoked download(), so the gate was never reached and remote code from repoB executed. DiffusionPipeline.from_pretrained('/local/snapshot', trust_remote_code=False) where the snapshot contains custom component files (e.g. unet/my_unet_model.py) referenced from model_index.json — same root cause; the local path skipped download() and custom component code executed. This vulnerability is fixed in 0.38.0.
Severity
HIGH
CVSS score
8.8
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2026-05-14 17:16:22.903000
Last modified
2026-10-26 14:10:00.130000
View original CVE JSON
{
"id": "CVE-2026-44513",
"sourceIdentifier": "[email protected]",
"published": "2026-05-14T17:16:22.903",
"lastModified": "2026-10-26T14:10:00.130",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, a trust_remote_code bypass in DiffusionPipeline.from_pretrained allows arbitrary remote code execution despite the user passing trust_remote_code=False (or omitting it, which is the default). The vulnerability has three variants, all sharing the same root cause — the trust_remote_code gate was implemented inside DiffusionPipeline.download() rather than at the actual dynamic-module load site, so any code path that bypassed or short-circuited download() also bypassed the security check. DiffusionPipeline.from_pretrained('repoA', custom_pipeline='attacker/repoB', trust_remote_code=False) — the gate evaluated against repoA's file list rather than repoB's, so repoB's pipeline.py was loaded and executed. DiffusionPipeline.from_pretrained('/local/snapshot', custom_pipeline='attacker/repoB', trust_remote_code=False) — the local-path branch never invoked download(), so the gate was never reached and remote code from repoB executed. DiffusionPipeline.from_pretrained('/local/snapshot', trust_remote_code=False) where the snapshot contains custom component files (e.g. unet/my_unet_model.py) referenced from model_index.json — same root cause; the local path skipped download() and custom component code executed. This vulnerability is fixed in 0.38.0."
},
{
"lang": "es",
"value": "Diffusers es la biblioteca para modelos de difusión preentrenados. Antes de la versión 0.38.0, una omisión de ’trust_remote_code’ en DiffusionPipeline.from_pretrained permite la ejecución remota de código arbitraria a pesar de que el usuario pase ’trust_remote_code=False’ (o lo omita, que es el valor predeterminado). La vulnerabilidad tiene tres variantes, todas compartiendo la misma causa raíz - la compuerta de ’trust_remote_code’ se implementó dentro de DiffusionPipeline.download() en lugar de en el sitio real de carga del módulo dinámico, por lo que cualquier ruta de código que omitiera o cortocircuitara download() también omitía la verificación de seguridad. DiffusionPipeline.from_pretrained(’repoA’, custom_pipeline=’atacante/repoB’, trust_remote_code=False) - la compuerta evaluó la lista de archivos de repoA en lugar de la de repoB, por lo que el pipeline.py de repoB fue cargado y ejecutado. DiffusionPipeline.from_pretrained(’/local/snapshot’, custom_pipeline=’atacante/repoB’, trust_remote_code=False) - la rama de ruta local nunca invocó download(), por lo que la compuerta nunca fue alcanzada y el código remoto de repoB se ejecutó. DiffusionPipeline.from_pretrained(’/local/snapshot’, trust_remote_code=False) donde la instantánea contiene archivos de componentes personalizados (p. ej., unet/my_unet_model.py) referenciados desde model_index.json - misma causa raíz; la ruta local omitió download() y el código del componente personalizado se ejecutó. Esta vulnerabilidad está corregida en la versión 0.38.0."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "huggingface",
"product": "diffusers",
"versions": [
{
"version": "< 0.38.0",
"status": "affected"
}
]
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
],
"versions": [
{
"version": "1787077779",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
],
"versions": [
{
"version": "1787076481",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-training-cuda128-torch29-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
],
"versions": [
{
"version": "1786611803",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-training-rocm64-torch29-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.4::el9"
],
"versions": [
{
"version": "1786611435",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhaiis/vllm-cpu-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhaiis/vllm-cuda-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhaiis/vllm-rocm-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhaiis/vllm-tpu-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhaii/vllm-cpu-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhaii/vllm-cuda-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-aws-cuda-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-azure-cuda-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-cuda-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-gcp-cuda-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-openvino-model-server-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-th06-cuda130-torch291-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-14T17:38:51.150920Z",
"id": "CVE-2026-44513",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-94"
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-358"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:huggingface:diffusers:*:*:*:*:*:python:*:*",
"versionEndExcluding": "0.38.0",
"matchCriteriaId": "D7F2A2AE-D122-46BA-BD64-67DCF4C22677"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/huggingface/diffusers/security/advisories/GHSA-98h9-4798-4q5v",
"source": "[email protected]",
"tags": [
"Exploit",
"Mitigation",
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:60520",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-44513",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477507",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44513.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
]
}