huggingface diffusers up to 0.37.x Pipeline Loading model_index.json from_pretrained custom_pipeline/trust_remote_code improper authentication

Summaryinfo

A vulnerability was found in huggingface diffusers up to 0.37.x. It has been rated as critical. Affected is the function from_pretrained of the file model_index.json of the component Pipeline Loading. Performing a manipulation of the argument custom_pipeline/trust_remote_code results in improper authentication. This vulnerability was named CVE-2026-45804. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as critical has been found in huggingface diffusers up to 0.37.x. This affects the function from_pretrained of the file model_index.json of the component Pipeline Loading. The manipulation of the argument custom_pipeline/trust_remote_code with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers' DiffusionPipeline.from_pretrained flow can bypass the trust_remote_code guard because download() validates model_index.json and custom pipeline code before later loading from a cached folder that can change, allowing a Hub repository with custom .py pipeline code to execute through the custom pipeline flow without passing custom_pipeline or trust_remote_code=True. This issue is fixed in version 0.38.0.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-45804 since 05/13/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

By approaching the search of inurl:model_index.json it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 0.38.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• huggingface

Name

• diffusers

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32
• 0.33
• 0.34
• 0.35
• 0.36
• 0.37

Website

• Product: https://github.com/huggingface/diffusers/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion