Skip to content
fr Sign in
7.5 High

CVE-2026-45804 Diffusers is the a library for pretrained diffusion models

Description

Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers' DiffusionPipeline.from_pretrained flow can bypass the trust_remote_code guard because download() validates model_index.json and custom pipeline code before later loading from a cached folder that can change, allowing a Hub repository with custom .py pipeline code to execute through the custom pipeline flow without passing custom_pipeline or trust_remote_code=True. This issue is fixed in version 0.38.0.

Affected products and versions

Product Affected versions Fixed in
diffusers 0.38 earliest → < 0.38.0 0.38.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of diffusers

The 4 CVEs of diffusers →
CVE-2026-65920 Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the… 5.3 Medium CVE-2026-44827 Diffusers is the a library for pretrained diffusion models 8.8 High CVE-2026-44513 Diffusers is the a library for pretrained diffusion models 8.8 High
Track this CVE