Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Background This vulnerability is found in the diffusers package - the transformers-equivalent library for diffusion models. It is found in the DiffusionPipeline.frompretrained flow, which is used to load a pipeline from the HuggingFace Hub. This function has a trustremotecode guard: if the repository’s modelindex.json references a custom pipeline class defined in a .py file in the repo, the load is blocked unless trustremotecode=True is explicitly passed: The vulnerability allows arbitrary code execution through the custom pipeline flow from a Hub repo, with no custompipeline or trustremotecode kwargs passed. The frompretrained call succeeds and returns a functional pipeline. --- Naive Flow DiffusionPipeline.frompretrained begins by popping all relevant arguments from kwargs into local variables, then calls DiffusionPipeline.download() to fetch the repo files: Inside download(), modelindex.json is fetched first as a standalone file via hfhubdownload: This config is used to detect…
Recommended action: Upgrade to 0.38.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, diffusers 0.37.0 allows remote code execution without the trust_remote_code=True safeguard when loading pipelines from Hugging Face Hub repositories. The _resolve_custom_pipeline_and_cls function in pipeline_loading_utils.py performs string interpolation on the custom_pipeline parameter using f"{custom_pipeline}.py". When custom_pipeline is not supplied by the user, it defaults to None, which Python interpolates as the literal string "None.py". If an attacker publishes a Hub repository containing a file named None.py with a class that subclasses DiffusionPipeline, the file is automatically downloaded and executed during a standard DiffusionPipeline.from_pretrained() call with no additional keyword arguments. The trust_remote_code check in DiffusionPipeline.download() is bypassed because it evaluates custom_pipeline is not None as False (since the kwarg was never supplied), while the downstream code path that…
Recommended action: Upgrade to 0.38.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A trustremotecode bypass in DiffusionPipeline.frompretrained allows arbitrary remote code execution despite the user passing trustremotecode=False (or omitting it, which is the default). The vulnerability has three variants, all sharing the same root cause — the trustremotecode gate was implemented inside DiffusionPipeline.download() rather than at the actual dynamic-module load site, so any code path that bypassed or short-circuited download() also bypassed the security check: 1. Cross-repo custompipeline. DiffusionPipeline.frompretrained('repoA', custompipeline='attacker/repoB', trustremotecode=False) — the gate evaluated against repoA's file list rather than repoB's, so repoB's pipeline.py was loaded and executed. 2. Local snapshot + Hub custompipeline. DiffusionPipeline.frompretrained('/local/snapshot', custompipeline='attacker/repoB', trustremotecode=False) — the local-path branch never invoked download(), so the gate was never reached and remote code from repoB executed.…
Recommended action: Upgrade to 0.38.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.