CVE-2026-45804highCWE-367

CVE-2026-45804: falha de alta gravidade em huggingface diffusers

Diffusers: TOCTOU Trust Remote Code Bypass

Publicada em

Seguir esta CVE+ Monitorar diffusers+ Monitorar diffusers

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.4%
Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers' DiffusionPipeline.from_pretrained flow can bypass the trust_remote_code guard because download() validates model_index.json and custom pipeline code before later loading from a cached folder that can change, allowing a Hub repository with custom .py pipeline code to execute through the custom pipeline flow without passing custom_pipeline or trust_remote_code=True. This issue is fixed in version 0.38.0.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
huggingface · diffusers
CVEs relacionadas — huggingface diffusers

No mesmo produto, das mais perigosas para as menos.

CVE-2026-44513HIGHDiffusers: `trust_remote_code` bypass via `custom_pipeline` and local custom componentsEPSS 1.1%CVE-2026-44827HIGHDiffusers: None.py Trust Remote Code BypassEPSS 0.7%CVE-2026-65920MEDIUMDiffusers Path Traversal via weight_map Arbitrary File ReadEPSS 0.4%