CVE-2026-45804

Name of the Vulnerable Software and Affected Versions diffusers (affected versions not specified)

Description A race condition exists in the DiffusionPipeline.from pretrained flow when loading pipelines from the HuggingFace Hub. The process involves two separate HTTP calls: one via hf hub download to fetch the model index.json configuration for a trust check, and a subsequent call via snapshot download to fetch the full repository content. Because these calls are not atomic, an attacker can update the repository between the two calls. By providing a clean configuration in the first call to pass the trust remote code guard and then pushing a malicious .py file and an updated configuration in the second call, the attacker can bypass the security check. This leads to arbitrary code execution when the resolve custom pipeline and cls function processes the downloaded snapshot and imports the malicious file via get pipeline class().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Pin the revision parameter to a specific commit hash when calling from pretrained to ensure both Hub calls resolve to the same content. Avoid loading pipelines from untrusted Hub repositories.