CVE-2026-45804: Diffusers Auth Bypass Vulnerability

CVE-2026-45804 Overview

CVE-2026-45804 is a trust_remote_code bypass in Hugging Face Diffusers, a library for pretrained diffusion models. Prior to version 0.38.0, DiffusionPipeline.from_pretrained validates model_index.json and custom pipeline code during the download() phase, then loads code from a cached folder that can change between validation and use. A Hub repository hosting custom .py pipeline code can execute through the custom pipeline flow without the caller passing custom_pipeline or trust_remote_code=True. The flaw is a time-of-check to time-of-use (TOCTOU) race condition tracked as [CWE-367].

Critical Impact

A malicious Hugging Face Hub repository can achieve arbitrary Python code execution on any host that loads it via DiffusionPipeline.from_pretrained, even when trust_remote_code is not explicitly enabled.

Affected Products

• Hugging Face Diffusers versions prior to 0.38.0
• Python applications and services that load models via DiffusionPipeline.from_pretrained
• ML pipelines and inference services consuming third-party Hugging Face Hub repositories

Discovery Timeline

• 2026-07-15 - CVE-2026-45804 published to NVD
• 2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-45804

Vulnerability Analysis

The vulnerability is a classic time-of-check to time-of-use (TOCTOU) flaw in the Diffusers loading pipeline. The download() function fetches and validates model_index.json and any custom pipeline code before the pipeline instantiation step. A subsequent load step reads from a cached folder that can change between validation and execution. This gap lets a Hub repository with custom .py code execute through the custom pipeline flow without the caller supplying custom_pipeline or trust_remote_code=True. The guard designed to require explicit user consent for remote code execution is therefore bypassed. Successful exploitation delivers arbitrary Python execution in the process that loads the model, affecting confidentiality, integrity, and availability of the host.

Root Cause

The root cause is the split between validation and use in DiffusionPipeline.from_pretrained. The trust_remote_code decision is enforced at download time, but the later load step re-reads from a cache path that is not re-verified. Additionally, trust_remote_code was not propagated to downstream loaders in auto_model.py and modular_pipeline.py, so remote code paths executed without the guard.

Attack Vector

An attacker publishes a Hugging Face Hub repository containing a crafted model_index.json and a malicious custom .py pipeline module. A victim invokes DiffusionPipeline.from_pretrained("attacker/repo") without trust_remote_code=True. The download step validates content that appears benign, but the subsequent load step reads attacker-controlled Python from the cached folder and executes it. User interaction is required in the form of loading the malicious repository.

# Security patch: src/diffusers/models/auto_model.py
                subfolder=subfolder,
                module_file=module_file,
                class_name=class_name,
+               trust_remote_code=trust_remote_code,
                **hub_kwargs,
            )
        else:

# Security patch: src/diffusers/modular_pipelines/modular_pipeline.py
            pretrained_model_name_or_path,
            module_file=module_file,
            class_name=class_name,
+           trust_remote_code=trust_remote_code,
            **hub_kwargs,
        )
# Source: https://github.com/huggingface/diffusers/commit/a37f6f8394ac2a7ee8360c3abea811efe54512b1

The patch propagates the trust_remote_code argument to downstream loaders, ensuring the guard is honored at the load step where remote Python is actually imported.

Detection Methods for CVE-2026-45804

Indicators of Compromise

• Presence of Hugging Face Hub repositories in the local cache (~/.cache/huggingface/) containing unexpected .py files alongside model_index.json.
• Python processes spawning child processes such as sh, bash, curl, wget, or python -c shortly after a Diffusers model load.
• Outbound network connections from ML inference hosts to unfamiliar domains immediately following pipeline instantiation.

Detection Strategies

• Inventory installed diffusers package versions across build agents, training clusters, and inference services and flag any version below 0.38.0.
• Audit application code for calls to DiffusionPipeline.from_pretrained that pass untrusted repository identifiers without a pinned revision hash.
• Enable Python import auditing (sys.addaudithook) in sensitive ML workloads to log dynamic imports triggered from cache directories.

Monitoring Recommendations

• Monitor process trees rooted in Python interpreters running Diffusers workloads for anomalous child processes and file writes.
• Alert on outbound connections from GPU worker nodes to non-allowlisted destinations following model download events.
• Log Hugging Face Hub download activity and correlate repository IDs against an approved-publisher allowlist.

How to Mitigate CVE-2026-45804

Immediate Actions Required

• Upgrade diffusers to version 0.38.0 or later across all environments that load pretrained pipelines.
• Restrict model loading to a curated allowlist of trusted Hugging Face publishers and pinned commit revisions.
• Purge the local Hugging Face cache and re-download models from vetted sources to remove any stale attacker-controlled .py files.

Patch Information

The issue is fixed in Diffusers 0.38.0. The fix, delivered in GitHub Pull Request #13448 and commit a37f6f8, propagates trust_remote_code to the downstream loaders in auto_model.py and modular_pipeline.py. Full release notes are available in the GitHub Release v0.38.0 and the GitHub Security Advisory GHSA-7wx4-6vff-v64p.

Workarounds

• Load only models from repositories you control or from a vetted mirror, and pin loads to a specific revision commit hash.
• Execute Diffusers workloads inside sandboxed containers with egress filtering and read-only filesystems where feasible.
• Run inference services under a dedicated low-privilege user account with no access to secrets or credential stores.

# Pin diffusers to a fixed, patched version
pip install --upgrade "diffusers>=0.38.0"

# Verify the installed version
python -c "import diffusers; print(diffusers.__version__)"

# When loading a model, pin the revision to a known-good commit
# python -c "from diffusers import DiffusionPipeline; \
#   DiffusionPipeline.from_pretrained('org/model', revision='<commit-sha>')"