The flaws affect Diffusers versions earlier than 0.38.0 and centre on the library’s trustremotecode safeguard. Developers rely on this setting to prevent unreviewed code bundled with models or pipelines from running on their systems. Crafted repositories could bypass that protection during several common loading processes.
The vulnerabilities have been grouped under CVE-2026-44513, which carries a severity score of 8.8 out of 10. Successful exploitation could give an attacker access to the permissions of the user or service loading the model, potentially enabling credential theft, data exfiltration, system modification or movement into connected infrastructure.
Diffusers is an open-source Python library used to run and train diffusion models for image, video and audio generation. Its integration with the Hugging Face Hub allows developers to download pretrained models and initialise them through commands such as DiffusionPipeline. from_pretrained().
Security researchers found that the library checked whether remote code was trusted during the download stage rather than at the point where dynamically supplied Python modules were loaded. Any route that avoided or shortened the normal download process could therefore reach the code-loading mechanism without triggering the intended security check.
One attack path used a model repository containing an apparently ordinary configuration file and a specially named Python file. A developer could load the repository without specifying a custom pipeline and without enabling remote code. The library would still locate and execute the attacker-controlled file while returning an operational pipeline, reducing the likelihood that the compromise would be noticed immediately.
A second variant involved explicitly referencing a custom pipeline hosted in another repository. Although the user could set trustremotecode=False, affected versions did not consistently enforce that choice when resolving and importing the external pipeline code.
The third variant targeted local snapshots. A repository downloaded or copied to local storage could include custom component files referenced by its model_index. json configuration. Loading that directory with remote-code permission disabled could execute the embedded Python components because the local path bypassed the download function containing the safeguard.
A related time-of-check-to-time-of-use weakness, tracked as CVE-2026-45804, showed how previously cached custom pipeline code could also undermine trust checks. That issue was assessed as high severity and affected versions below 0.38.0, although vulnerability databases have recorded changes to its advisory status as maintainers consolidated the underlying problem and affected paths.
Hugging Face addressed the weaknesses in Diffusers 0.38.0 by moving enforcement closer to the dynamic-module loading point and tightening validation across remote, cached and local sources. Organisations using the package have been advised to upgrade and verify that applications, notebooks, inference services and container images are not pinning older releases.
The findings highlight a broader security problem in model-sharing ecosystems. Machine-learning packages frequently combine data, configuration files, weights and executable Python components. A repository presented as a model can therefore behave more like a software package when loaded, even though users may treat it as passive content.
Research into model-hosting platforms has found widespread dependence on custom loading code, inconsistent enforcement of safety controls and confusion among developers about what remote-code settings protect. Separate studies of hundreds of thousands of hosted models have identified malicious artefacts capable of reconnaissance, credential theft and reverse-shell activity.
The Diffusers flaws do not mean every model hosted on Hugging Face is unsafe. Exploitation requires a user or automated service to load a repository prepared by an attacker. The risk rises in systems that automatically test community models, process unverified submissions or grant inference workers access to cloud credentials and internal networks.
Developers can reduce exposure by treating model repositories as untrusted software, reviewing configuration and Python files before loading them, isolating model execution in restricted containers and limiting access to secrets. Pinning repository revisions can also prevent reviewed code from being replaced after approval.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
