CVE-2026-44827

Published: Mag 14, 2026 Last Modified: Mag 19, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,8
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, diffusers 0.37.0 allows remote code execution without the trust_remote_code=True safeguard when loading pipelines from Hugging Face Hub repositories. The _resolve_custom_pipeline_and_cls function in pipeline_loading_utils.py performs string interpolation on the custom_pipeline parameter using f'{custom_pipeline}.py'. When custom_pipeline is not supplied by the user, it defaults to None, which Python interpolates as the literal string 'None.py'. If an attacker publishes a Hub repository containing a file named None.py with a class that subclasses DiffusionPipeline, the file is automatically downloaded and executed during a standard DiffusionPipeline.from_pretrained() call with no additional keyword arguments. The trust_remote_code check in DiffusionPipeline.download() is bypassed because it evaluates custom_pipeline is not None as False (since the kwarg was never supplied), while the downstream code path that actually loads the module resolves the None value into a valid filename. An attacker can achieve silent arbitrary code execution by publishing a malicious model repository with a None.py file and a standard-looking model_index.json that references a legitimate pipeline class name, requiring only that a victim calls from_pretrained on the repository. This vulnerability is fixed in 0.38.0.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0012
Percentile
0,3th
Updated

EPSS Score Trend (Last 6 Days)

94

Improper Control of Generation of Code ('Code Injection')

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control Integrity Confidentiality Availability Non-Repudiation
Potential Impacts:
Bypass Protection Mechanism Gain Privileges Or Assume Identity Execute Unauthorized Code Or Commands Hide Activities
Applicable Platforms
Languages: Interpreted
Technologies: AI/ML
Likelihood of Exploit: Medium
View CWE Details
Application

Diffusers by Huggingface

Product Information
Vendor Huggingface
Product Diffusers
Version Range Affected
To 0.38.0 (exclusive)
cpe:2.3:a:huggingface:diffusers:*:*:*:*:*:python:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://github.com/huggingface/diffusers/security/advisorie…
https://github.com/huggingface/diffusers/security/advisories/GHSA-j7w6-vpvq-j3gm
https://github.com/huggingface/diffusers/security/advisorie…
https://github.com/huggingface/diffusers/security/advisories/GHSA-j7w6-vpvq-j3gm