Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-15T16:05:35 diffusers: Diffusers: Arbitrary code execution due to trust_remote_code guard bypass 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CWE-94

Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers' DiffusionPipeline.from_pretrained flow can bypass the trust_remote_code guard because download() validates model_index.json and custom pipeline code before later loading from a cached folder that can change, allowing a Hub repository with custom .py pipeline code to execute through the custom pipeline flow without passing custom_pipeline or trust_remote_code=True. This issue is fixed in version 0.38.0.

A flaw was found in Diffusers, a library for pretrained diffusion models. A remote attacker could exploit this vulnerability by crafting a malicious Hub repository with custom Python pipeline code. The `DiffusionPipeline.from_pretrained` flow can bypass the `trust_remote_code` security mechanism, allowing the execution of arbitrary code on the system when a user interacts with the malicious repository. This could lead to high impact on confidentiality, integrity, and availability of the affected system.

This Important flaw in Diffusers, as used in Red Hat AI Inference Server, Red Hat OpenShift AI, and Red Hat Enterprise Linux AI, allows for arbitrary code execution. A remote attacker could exploit this by convincing a user to load a specially crafted model from a malicious Hub repository, bypassing the `trust_remote_code` safeguard. This could lead to a complete compromise of the system where the model is loaded. Red Hat AI Inference Server Affected rhaiis/vllm-cpu-rhel9 Red Hat AI Inference Server Not affected rhaiis/vllm-cuda-rhel9 Red Hat AI Inference Server Not affected rhaiis/vllm-rocm-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-tpu-rhel9 Red Hat AI Inference Server Affected rhaii/vllm-cpu-rhel9 Red Hat AI Inference Server Affected rhaii/vllm-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-aws-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-azure-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-gcp-cuda-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-openvino-model-server-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-cuda130-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cuda130-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-rocm64-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-training-cuda128-torch29-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-training-rocm64-torch29-py312-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-45804 https://nvd.nist.gov/vuln/detail/CVE-2026-45804 https://github.com/huggingface/diffusers/commit/a37f6f8394ac2a7ee8360c3abea811efe54512b1 https://github.com/huggingface/diffusers/issues/13446 https://github.com/huggingface/diffusers/pull/13448 https://github.com/huggingface/diffusers/releases/tag/v0.38.0 https://github.com/huggingface/diffusers/security/advisories/GHSA-7wx4-6vff-v64p