Affected Systems
Hugging Face Diffusers library versions prior to 0.38.0. Affects any user invoking DiffusionPipeline.from_pretrained with custom pipelines. The library has over 8.1 million downloads monthly and is widely embedded in enterprise AI production pipelines, CI/CD systems, and container images.
Exploitation Status
No evidence of active exploitation reported. Vulnerabilities disclosed responsibly and patched in May 2026 (Diffusers 0.38.0). Technical details and attack vectors publicly documented, increasing risk of future exploitation.
Business Impact
Attackers can achieve remote code execution by hosting malicious model repositories on Hugging Face Hub. The flaws exploit TOCTOU race conditions in the model loading process, allowing arbitrary Python code execution even when trust_remote_code is set to False or omitted. This threatens AI supply chain integrity in enterprises using Diffusers for production workloads, potentially granting attackers access to ML pipelines, training infrastructure, and downstream systems. Three CVEs assigned: CVE-2026-44827 (CVSS 8.8), CVE-2026-45804 (CVSS 7.5), and CVE-2026-44513 (CVSS 8.8).
Urgency
🟠 Within 24 hours
Recommended Actions
- Upgrade Hugging Face Diffusers to version 0.38.0 or later immediately on all systems using the library
- Audit all AI/ML pipelines and CI/CD workflows that call DiffusionPipeline.from_pretrained to identify exposure scope
- Restrict model loading to only fully trusted and audited Hugging Face repositories; avoid loading custom_pipeline parameters pointing to unverified Hub repositories
- Inspect local model snapshots for unexpected .py files in component subdirectories (unet/, scheduler/) and snapshot root before loading
- Implement network-level controls to monitor and log outbound connections to huggingface.co from production ML systems for anomaly detection