Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Diffusers versions before 0.38.0 contain a bypass of the trust_remote_code check in DiffusionPipeline.from_pretrained, which can run remote code even when trust_remote_code is False or omitted. An attacker who can get a user to load a crafted custom pipeline, from a different Hub repository or from a local snapshot with custom component files, can execute arbitrary code on that user's machine. Upgrade to diffusers 0.38.0 or later. Until then, load only audited sources and do not use custom_pipeline pointing to a repository other than the primary one.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 8.8 | High | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.011, the 65th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:11 UTC First seen by agentprime
- 31 Oct 2026, 14:11 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-98h9-4798-4q5v
- OSV: GHSA-98h9-4798-4q5v
- github.com/huggingface/diffusers/security/advisories/GHSA-98h9-4798-4q5v
- nvd.nist.gov/vuln/detail/CVE-2026-44513
- github.com/huggingface/diffusers/issues/13446
- github.com/huggingface/diffusers/pull/13448
- github.com/huggingface/diffusers/commit/a37f6f8394ac2a7ee8360c3abea811efe54512b1
- github.com/huggingface/diffusers
- github.com/huggingface/diffusers/releases/tag/v0.38.0
- github.com/pypa/advisory-database/tree/main/vulns/diffusers/PYSEC-2026-40.yaml