CVE-2026-45804: Diffusers: TOCTOU Trust Remote Code Bypass
Vulnerability summary
CVE-2026-45804 is a high (CVSS 7.5) vulnerability in huggingface diffusers. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 30.9% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 15-07-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers' DiffusionPipeline.from_pretrained flow can bypass the trust_remote_code guard because download() validates model_index.json and custom pipeline code before later loading from a cached folder that can change, allowing a Hub repository with custom .py pipeline code to execute through the custom pipeline flow without passing custom_pipeline or trust_remote_code=True. This issue is fixed in version 0.38.0.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · PypiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.37%
Chance of exploitation in the next 30 days
Percentile
31%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.37% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundDiffusers
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard8 products
- py3.10-diffusers-cuda-12.9All versions (No fix recorded)
- py3.10-diffusers-cuda-13.0All versions (No fix recorded)
- py3.11-diffusers-cuda-12.9< 0.38.0-r0
- py3.11-diffusers-cuda-13.0< 0.38.0-r0
- py3.12-diffusers-cuda-12.9< 0.38.0-r0
Huggingface1 product
- diffusers< 0.38.0
PyPI1 product
- diffusers< 0.38.0
3 vendors · 10 products
References
11 links- github.com/huggingface/diffusers/security/advisories/GHSA-7wx4-6vff-v64pX Refsource CONFIRMWEBAdvisoryVendor AdvisoryExploit
- github.com/huggingface/diffusers/commit/a37f6f8394ac2a7ee8360c3abea811efe54512b1X Refsource MISCWEBFIXPatch
- pypi.org/project/diffusersPACKAGE