Skip to content
Fencer Vulns
high 7.5

CVE-2026-45804 json

Diffusers: TOCTOU Trust Remote Code Bypass

published 2026-05-20 5 mo ago modified 2026-10-24 15 d ago also GHSA-7wx4-6vff-v64p , PYSEC-2026-2446 , EUVD-2026-44711

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 31%
public exploits
0
none known

Summary

Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers' DiffusionPipeline.from_pretrained flow can bypass the trust_remote_code guard because download() validates model_index.json and custom pipeline code before later loading from a cached folder that can change, allowing a Hub repository with custom .py pipeline code to execute through the custom pipeline flow without passing custom_pipeline or trust_remote_code=True. This issue is fixed in version 0.38.0.

Patch / fix

  • pypi diffusers 0.38.0
  • huggingface diffusers 0.38.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-45804 updated cvss 7.5

diffusers: Diffusers: Arbitrary code execution due to trust_remote_code guard bypass

  • Red Hat AI Inference Server rhaiis/vllm-tpu-rhel9
    affected: no fix planned “Will not fix”
  • Red Hat AI Inference Server 3.4 rhaii/vllm-cpu-rhel9 1789681128, rhaii/vllm-cpu-rhel9 1790075793, rhaii/vllm-cuda-rhel9 1789681126, rhaii/vllm-cuda-rhel9 1790090131
    fixed: vendor fix RHSA-2026:69466
  • Red Hat Enterprise Linux AI 3.4 rhelai3/bootc-cuda-rhel9 1790868254, rhelai3/bootc-aws-cuda-rhel9 1790881122, rhelai3/bootc-gcp-cuda-rhel9 1790881123, rhelai3/disk-image-cuda-rhel9 1790957417, rhelai3/bootc-azure-cuda-rhel9 1790881120
    fixed: vendor fix RHSA-2026:76150
  • Red Hat OpenShift AI 3.4 rhoai/odh-th06-rocm64-torch291-py312-rhel9 1787076481, rhoai/odh-th06-cuda130-torch210-py312-rhel9 1787077779, rhoai/odh-training-rocm64-torch29-py312-rhel9 1786611435, rhoai/odh-training-cuda128-torch29-py312-rhel9 1786611803
    fixed: vendor fix RHSA-2026:60520
  • Red Hat AI Inference Server rhaiis/vllm-rocm-rhel9 Red Hat Enterprise Linux AI 3.4 rhelai3/bootc-rocm-rhel9 1790614447, rhelai3/bootc-azure-rocm-rhel9 1790707552
    not affected: vulnerable code not present
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-openvino-model-server-rhel9, rhoai/odh-th06-cuda130-torch291-py312-rhel9
    not affected: component not present
  • Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1787330837, rhoai/rhai-cli-rhel9 1787330837, rhoai/odh-automl-rhel9 1786612415, rhoai/odh-mlflow-rhel9 1787226790, rhoai/odh-autorag-rhel9 1786612637, rhoai/odh-trainer-rhel9 1787089049, +96 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
3 mo ago

Exploit prediction

0.37% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/huggingface/diffusers/security/advisories/GHSA-7wx4-6vff-v64p referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/huggingface/diffusers/issues/13446 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
pypi diffusers
<0.38.0
0.38.0

Affected products

  • huggingface diffusers

Classification

Weakness
  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.