What is the CVSS score of CVE-2026-44827?

CVE-2026-44827 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of HuggingFace Diffusers are affected by CVE-2026-44827?

HuggingFace Diffusers library versions below 0.38.0 contain a remote code execution vulnerability that allows attackers to execute arbitrary Python code when users load machine learning pipelines…. A patch is available.

How to fix or mitigate CVE-2026-44827?

Within 24 hours: Inventory all systems and development environments running HuggingFace Diffusers below version 0.38.0 and restrict access to Hugging Face Hub. Within 7 days: Upgrade all instances to Diffusers version 0.38.0 or later across production, staging, and development environments. Within 30 days: Conduct code review of any pipelines loaded from untrusted sources in the past 12 months and implement network segmentation to limit Hub repository access to vetted sources only.

HuggingFace Diffusers CVE-2026-44827

EUVD-2026-30332 HIGH

Code Injection (CWE-94)

2026-05-14 GitHub_M

GHSA-j7w6-vpvq-j3gm

Python Code Injection RCE

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 14, 2026 - 18:32 EUVD

Source Code Evidence Fetched

May 14, 2026 - 17:32 vuln.today

Analysis Generated

May 14, 2026 - 17:32 vuln.today

CVE Published

May 14, 2026 - 16:33 nvd

HIGH 8.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 pypi packages depend on diffusers (2 direct, 1 indirect)

Ecosystem-wide dependent count for version 0.38.0.

DescriptionGitHub Advisory

Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, diffusers 0.37.0 allows remote code execution without the trust_remote_code=True safeguard when loading pipelines from Hugging Face Hub repositories. The _resolve_custom_pipeline_and_cls function in pipeline_loading_utils.py performs string interpolation on the custom_pipeline parameter using f"{custom_pipeline}.py". When custom_pipeline is not supplied by the user, it defaults to None, which Python interpolates as the literal string "None.py". If an attacker publishes a Hub repository containing a file named None.py with a class that subclasses DiffusionPipeline, the file is automatically downloaded and executed during a standard DiffusionPipeline.from_pretrained() call with no additional keyword arguments. The trust_remote_code check in DiffusionPipeline.download() is bypassed because it evaluates custom_pipeline is not None as False (since the kwarg was never supplied), while the downstream code path that actually loads the module resolves the None value into a valid filename. An attacker can achieve silent arbitrary code execution by publishing a malicious model repository with a None.py file and a standard-looking model_index.json that references a legitimate pipeline class name, requiring only that a victim calls from_pretrained on the repository. This vulnerability is fixed in 0.38.0.

AnalysisAI

Remote code execution in HuggingFace Diffusers library (versions < 0.38.0) allows attackers to execute arbitrary Python code when victims load malicious pipelines from Hugging Face Hub repositories. The vulnerability bypasses the trust_remote_code=True safeguard through a type coercion flaw where None values are interpolated as 'None.py' filenames. Attackers can achieve silent code execution by publishing repositories containing a malicious None.py file alongside legitimate-looking configuration, requiring only that victims call DiffusionPipeline.from_pretrained() on the attacker's repository. EPSS data not available; no public exploit identified at time of analysis. Vendor-released patch: version 0.38.0.

Technical ContextAI

The vulnerability exploits Python's string interpolation behavior in the _resolve_custom_pipeline_and_cls function within pipeline_loading_utils.py. When the custom_pipeline parameter is not supplied, Python's default None value undergoes string interpolation via f-string formatting (f'{custom_pipeline}.py'), producing the literal string 'None.py'. The trust_remote_code security check evaluates 'custom_pipeline is not None' as False when the parameter is absent from kwargs, but downstream module loading logic treats the interpolated 'None.py' as a valid filename target. This creates a logic bypass where the security gate checks for explicit None but the file resolution accepts implicit string 'None'. The vulnerability is a CWE-94 (Improper Control of Generation of Code) instance, specifically exploiting type coercion between NoneType and string representations in security-critical path validation. The affected component is the Diffusers library's pipeline loading mechanism from Hugging Face Hub, which uses huggingface_hub's snapshot_download functionality with allow_patterns filtering that inadvertently includes attacker-controlled filenames.

RemediationAI

Upgrade HuggingFace Diffusers to version 0.38.0 or later, which includes the fix from GitHub pull request #13448 and commit a37f6f8394ac2a7ee8360c3abea811efe54512b1. For Python environments managed via pip, execute 'pip install --upgrade diffusers>=0.38.0' and verify installation with 'pip show diffusers'. Organizations unable to immediately upgrade should implement compensating controls: restrict DiffusionPipeline.from_pretrained() calls to explicitly trusted repository sources through application-layer allowlists of Hub repository IDs, deploy network egress filtering to block unauthorized connections to huggingface.co from production ML inference environments (note: this breaks legitimate model downloads and requires pre-cached models), or enforce mandatory code review of all model_index.json configurations before loading with validation that _class_name references only standard pipeline classes and no None.py files exist in repository snapshots. These workarounds significantly impact operational workflows and model update agility. Additionally, audit existing cached model directories (typically ~/.cache/huggingface/hub/) for suspicious None.py files as indicators of potential prior exploitation. Consult the official advisory at https://github.com/huggingface/diffusers/security/advisories/GHSA-j7w6-vpvq-j3gm for vendor guidance.