Read the docs
TI-2026-33539 Aliases CVE-2026-45804GHSA-7wx4-6vff-v64p

Diffusers: TOCTOU Trust Remote Code Bypass

Priority HIGH 68CWE-367Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 3 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers' DiffusionPipeline.from_pretrained flow can bypass the trust_remote_code guard because download() validates model_index.json and custom pipeline code before later loading from a cached folder that can change, allowing a Hub repository with custom .py pipeline code to execute through the custom pipeline flow without passing custom_pipeline or trust_remote_code=True. This issue is fixed in version 0.38.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0037 31st percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial diffusers (huggingface): 0.38.0diffusers (PyPI): 0.38.0Red Hat: 7 advisoriesRed Hat: 3 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
huggingfacediffusersbefore 0.38.00.38.0Patch availableCNA
—diffusers (PyPI)before 0.38.00.38.0Patch availableGHSA-7wx4-6vff-v64p
  • diffusers Vendorhuggingface Affected before 0.38.0 Fixed in 0.38.0 Patch available CNA
  • diffusers (PyPI) Vendor— Affected before 0.38.0 Fixed in 0.38.0 Patch available GHSA-7wx4-6vff-v64p

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:huggingface:diffusers:*:*:*:*:*:python:*:*before 0.38.0Vulnerablehuggingface
  • cpe:2.3:a:huggingface:diffusers:*:*:*:*:*:python:*:* Versions before 0.38.0 Vulnerable ·huggingface

Remediation

  • Fix · CNA diffusers (huggingface) Fixed in 0.38.0
  • Fix · GHSA-7wx4-6vff-v64p diffusers (PyPI) Fixed in 0.38.0 Advisory →

Red Hat 7 advisories

  • RHSA-2026:76150 Released 2026-10-05 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.4.5 security update
    • Red Hat Enterprise Linux AI 3.4 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
  • RHSA-2026:76149 Released 2026-10-05 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.4.5 security update
    • Red Hat Enterprise Linux AI 3.4 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
  • RHSA-2026:70979 Released 2026-09-23 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (cuda)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cuda-rhel9
Show 4 more Red Hat advisories
  • RHSA-2026:70965 Released 2026-09-23 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (cpu)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cpu-rhel9
  • RHSA-2026:69467 Released 2026-09-21 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (cuda)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cuda-rhel9
  • RHSA-2026:69466 Released 2026-09-21 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (cpu)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cpu-rhel9
  • RHSA-2026:60520 Released 2026-08-27 · Red Hat rating Critical
    RHOAI 3.4.4 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AI Inference ServerAffectedNo fix planned: Will not fix
Red Hat AI Inference Server 3.4Fixed RHSA-2026:69466, RHSA-2026:69467, RHSA-2026:70965, RHSA-2026:70979
Red Hat Enterprise Linux AI 3.4Fixed RHSA-2026:76149, RHSA-2026:76150
Red Hat OpenShift AI 3.4Fixed RHSA-2026:60520
Not affected: 4 products
  • Red Hat AI Inference Server
  • Red Hat Enterprise Linux AI 3.4
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 3.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45804
  2. 2026-10-03 Alias added: GHSA-7wx4-6vff-v64p
  3. 2026-10-06 Fix available: RHSA-2026:76149 · Red Hat
  4. 2026-10-06 Fix available: RHSA-2026:76150 · Red Hat
  5. 2026-10-06 Fix available: Red Hat Enterprise Linux AI 3.4 · Red Hat

References

Exploit 2

Patch 1

Advisory 1

Other 4

  • TI-2026-32710 Diffusers: None.py Trust Remote Code Bypass CVSS 3.1HIGH 8.8
  • TI-2026-32443 Diffusers: `trust_remote_code` bypass via `custom_pipeline` and local custom components CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences