Hugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Code

Three high-severity security flaws have been disclosed in Hugging Face's Diffusers library that could allow crafted model repositories to stealthily execute arbitrary code on machines that load it, opening the artificial intelligence AI supply chain to security risk. "These vulnerabilities are...

CVE-2026-65920

A flaw was found in Diffusers. This path traversal vulnerability in the getcheckpointshardfiles function allows a remote attacker to read arbitrary files. By supplying malicious weightmap values in model index JSON, an attacker can use ../ sequences or absolute paths to escape the model directory...

aana (>=0.2.1, <=0.2.2), abgrouponline (>=1.0.0, <=1.0.2) +563 more potentially affected by CVE-2026-65920 via diffusers (>=0.2.4, <=0.40.0)

diffusers PYPI version =0.2.4, =0.2.1, =1.0.0, =0.1.1, =0.2.1, =20260210.0.0, =0.2.14, =0.1.2, =0.0.1, =0.0.3, =0.10.6, =0.0.1, =0.0.1, =1.8.20, =1.19.0 and more Source cves: CVE-2026-65920 Source advisory: SNYK:PYTHON-DIFFUSERS-18313062...

Directory Traversal

Overview diffusers is a State-of-the-art diffusion in PyTorch and JAX. Affected versions of this package are vulnerable to Directory Traversal via the getcheckpointshardfiles function. An attacker can access arbitrary files by providing crafted weightmap values containing directory traversal...

CVE-2026-65920

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the getcheckpointshardfiles function that allows attackers to read arbitrary files by supplying malicious weightmap values in model index JSON. Attackers can use ../ sequences or absolute paths in...

CVE-2026-65920

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the getcheckpointshardfiles function that allows attackers to read arbitrary files by supplying malicious weightmap values in model index JSON. Attackers can use ../ sequences or absolute paths in...

CVE-2026-65920

Diffusers up to 0.39.0 is affected by a path traversal in the _get_checkpoint_shard_files function. Attackers can supply malicious weight_map values in the model index JSON (e.g., ../ sequences or absolute paths) to escape the model directory and read safetensors files outside the intended locati...

EUVD-2026-48343

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the getcheckpointshardfiles function that allows attackers to read arbitrary files by supplying malicious weightmap values in model index JSON. Attackers can use ../ sequences or absolute paths in...

CVE-2026-65920 Diffusers Path Traversal via weight_map Arbitrary File Read

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the getcheckpointshardfiles function that allows attackers to read arbitrary files by supplying malicious weightmap values in model index JSON. Attackers can use ../ sequences or absolute paths in...

CVE-2026-65920 Diffusers Path Traversal via weight_map Arbitrary File Read

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the getcheckpointshardfiles function that allows attackers to read arbitrary files by supplying malicious weightmap values in model index JSON. Attackers can use ../ sequences or absolute paths in...

CVE-2026-65920 Diffusers Path Traversal via weight_map Arbitrary File Read

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the getcheckpointshardfiles function that allows attackers to read arbitrary files by supplying malicious weightmap values in model index JSON. Attackers can use ../ sequences or absolute paths in...

CVE-2026-65920: Improper Limitation of a Pathname to a Restricted Directory

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the getcheckpointshardfiles function that allows attackers to read arbitrary files by supplying malicious weightmap values in model index JSON. Attackers can use ../ sequences or absolute paths in...

PT-2026-64045

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the get checkpoint shard files function that allows attackers to read arbitrary files by supplying malicious weight map values in model index JSON. Attackers can use ../ sequences or absolute paths in...

CVE-2026-45804

A flaw was found in Diffusers, a library for pretrained diffusion models. A remote attacker could exploit this vulnerability by crafting a malicious Hub repository with custom Python pipeline code. The DiffusionPipeline.frompretrained flow can bypass the trustremotecode security mechanism, allowi...

CVE-2026-45804

Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers' DiffusionPipeline.frompretrained flow can bypass the trustremotecode guard because download validates modelindex.json and custom pipeline code before later loading from a cached folder that can change, allowin...

CVE-2026-45804 Diffusers: TOCTOU Trust Remote Code Bypass

Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers' DiffusionPipeline.frompretrained flow can bypass the trustremotecode guard because download validates modelindex.json and custom pipeline code before later loading from a cached folder that can change, allowin...

CVE-2026-45804 Diffusers: TOCTOU Trust Remote Code Bypass

Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers' DiffusionPipeline.frompretrained flow can bypass the trustremotecode guard because download validates modelindex.json and custom pipeline code before later loading from a cached folder that can change, allowin...

CVE-2026-45804 Diffusers: TOCTOU Trust Remote Code Bypass

Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers' DiffusionPipeline.frompretrained flow can bypass the trustremotecode guard because download validates modelindex.json and custom pipeline code before later loading from a cached folder that can change, allowin...

CVE-2026-45804

Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers' DiffusionPipeline.frompretrained flow can bypass the trustremotecode guard because download validates modelindex.json and custom pipeline code before later loading from a cached folder that can change, allowin...

CVE-2026-45804

Diffusers CVE-2026-45804 describes a TOCTOU race in DiffusionPipeline.from_pretrained where two Hub fetches (config via hf_hub_download and a snapshot via snapshot_download) can resolve to different commits. An attacker could push commit B after the first check, causing the newer commit’s model_i...