CVE-2026-44827

# Victim side code (Vulnerable scenario) from diffusers import DiffusionPipeline # User loads a model from a repository, assuming it's safe without trust_remote_code=True # The repository contains a malicious file named 'None.py' pipeline = DiffusionPipeline.from_pretrained("attacker/malicious-repo") # Attacker side: Repository structure # attacker/malicious-repo/ # ├── model_index.json # ├── None.py (Malicious payload) # └── ... # Content of None.py (Example payload) import os class MaliciousPipeline: def __init__(self): print("Executing arbitrary code!") os.system("id") # Arbitrary command execution

{"cve": {"id": "CVE-2026-44827", "sourceIdentifier": "[email protected]", "published": "2026-05-14T17:16:23.500", "lastModified": "2026-05-14T18:30:57.103", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, diffusers 0.37.0 allows remote code execution without the trust_remote_code=True safeguard when loading pipelines from Hugging Face Hub repositories. The _resolve_custom_pipeline_and_cls function in pipeline_loading_utils.py performs string interpolation on the custom_pipeline parameter using f\"{custom_pipeline}.py\". When custom_pipeline is not supplied by the user, it defaults to None, which Python interpolates as the literal string \"None.py\". If an attacker publishes a Hub repository containing a file named None.py with a class that subclasses DiffusionPipeline, the file is automatically downloaded and executed during a standard DiffusionPipeline.from_pretrained() call with no additional keyword arguments. The trust_remote_code check in DiffusionPipeline.download() is bypassed because it evaluates custom_pipeline is not None as False (since the kwarg was never supplied), while the downstream code path that actually loads the module resolves the None value into a valid filename. An attacker can achieve silent arbitrary code execution by publishing a malicious model repository with a None.py file and a standard-looking model_index.json that references a legitimate pipeline class name, requiring only that a victim calls from_pretrained on the repository. This vulnerability is fixed in 0.38.0."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-94"}]}], "references": [{"url": "https://github.com/huggingface/diffusers/security/advisories/GHSA-j7w6-vpvq-j3gm", "source": "[email protected]"}, {"url": "https://github.com/huggingface/diffusers/security/advisories/GHSA-j7w6-vpvq-j3gm", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}}