8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44513

CVE-2026-44513: Diffusers: `trust_remote_code` bypass via `custom_pipeline` and local custom components

Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, a trust_remote_code bypass in DiffusionPipeline.from_pretrained allows arbitrary remote code execution despite the user passing trust_remote_code=False (or omitting it, which is the default). The vulnerability has three variants, all sharing the same root cause — the trust_remote_code gate was implemented inside DiffusionPipeline.download() rather than at the actual dynamic-module load site, so any code path that bypassed or short-circuited download() also bypassed the security check. DiffusionPipeline.from_pretrained('repoA', custom_pipeline='attacker/repoB', trust_remote_code=False) — the gate evaluated against repoA's file list rather than repoB's, so repoB's pipeline.py was loaded and executed. DiffusionPipeline.from_pretrained('/local/snapshot', custom_pipeline='attacker/repoB', trust_remote_code=False) — the local-path branch never invoked download(), so the gate was never reached and remote code from repoB executed. DiffusionPipeline.from_pretrained('/local/snapshot', trust_remote_code=False) where the snapshot contains custom component files (e.g. unet/my_unet_model.py) referenced from model_index.json — same root cause; the local path skipped download() and custom component code executed. This vulnerability is fixed in 0.38.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44513

CVE-2026-44513:

8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
diffusers	pip	< 0.38.0	0.38.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a trust_remote_code bypass in the diffusers library, allowing for remote code execution. The root cause was that the security check for trust_remote_code was implemented in DiffusionPipeline.download(), which was not always executed, especially when loading models from a local path or using the custom_pipeline feature. This allowed an attacker to execute arbitrary code by crafting a malicious model or pipeline.

The patch addresses this by moving the trust_remote_code check to a lower-level, centralized function, get_cached_module_file, which is always called when a dynamic module is loaded. The patch also updates the user-facing API functions like DiffusionPipeline.from_pretrained, AutoModel.from_pretrained, and ModularPipeline.from_pretrained to accept the trust_remote_code parameter and pass it down the call stack.

Therefore, the key vulnerable functions are the entry points that users call (*.from_pretrained) and the functions involved in the flawed security check (DiffusionPipeline.download) and the actual code loading (get_cached_module_file). Exploitation would involve a call to one of the from_pretrained methods, which would then trigger the vulnerable code path that loads and executes untrusted Python code.

Vulnerable functions

DiffusionPipeline.from_pretrained

src/diffusers/pipelines/pipeline_utils.py

This is the primary user-facing function that was vulnerable. When called with a local path or a `custom_pipeline` argument, it could lead to arbitrary code execution because the `trust_remote_code` check was not performed correctly or was bypassed entirely. The patch ensures the `trust_remote_code` parameter is respected throughout the model loading process.

DiffusionPipeline.download

src/diffusers/pipelines/pipeline_utils.py

This function contained the original, but flawed, `trust_remote_code` check. The vulnerability stemmed from the fact that this `download` function was not always called (e.g., when loading from a local directory), allowing the security check to be bypassed. The fix moved the check to a more centralized location.

get_cached_module_file

src/diffusers/utils/dynamic_modules_utils.py

This function is responsible for retrieving module files. Before the patch, it would load files from local or remote locations without any security check, which is the root cause of the vulnerability. The fix was to implement the `trust_remote_code` check within this function, making it the central point for controlling custom code execution.

AutoModel.from_pretrained

src/diffusers/models/auto_model.py

Similar to `DiffusionPipeline.from_pretrained`, this function serves as an entry point for loading models and was vulnerable. It could load custom code without adhering to the `trust_remote_code` setting. The patch rectifies this by propagating the `trust_remote_code` parameter.

ModularPipeline.from_pretrained

src/diffusers/modular_pipelines/modular_pipeline.py

This is another user-facing entry point for loading pipelines that was vulnerable. It could execute untrusted code by bypassing the `trust_remote_code` check. The patch ensures the check is correctly applied.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.