Diffusers
Monthly
Remote code execution in HuggingFace Diffusers library (versions < 0.38.0) allows attackers to execute arbitrary Python code when victims load malicious pipelines from Hugging Face Hub repositories. The vulnerability bypasses the trust_remote_code=True safeguard through a type coercion flaw where None values are interpolated as 'None.py' filenames. Attackers can achieve silent code execution by publishing repositories containing a malicious None.py file alongside legitimate-looking configuration, requiring only that victims call DiffusionPipeline.from_pretrained() on the attacker's repository. EPSS data not available; no public exploit identified at time of analysis. Vendor-released patch: version 0.38.0.
Path traversal in HuggingFace Diffusers through 0.39.0 enables arbitrary file reads when a user or pipeline loads a maliciously crafted model. The `_get_checkpoint_shard_files` function in `hub_utils.py` blindly resolves `weight_map` shard filenames from model index JSON without validating for path separators or absolute paths, allowing an attacker who controls a model repository to escape the model directory and read any file accessible to the Diffusers process. No active exploitation confirmed (not in CISA KEV), but a public POC issue exists on GitHub and the attack surface includes the widely-used HuggingFace Hub ecosystem.
Remote code execution in HuggingFace Diffusers library (versions < 0.38.0) allows attackers to execute arbitrary Python code when victims load malicious pipelines from Hugging Face Hub repositories. The vulnerability bypasses the trust_remote_code=True safeguard through a type coercion flaw where None values are interpolated as 'None.py' filenames. Attackers can achieve silent code execution by publishing repositories containing a malicious None.py file alongside legitimate-looking configuration, requiring only that victims call DiffusionPipeline.from_pretrained() on the attacker's repository. EPSS data not available; no public exploit identified at time of analysis. Vendor-released patch: version 0.38.0.
Path traversal in HuggingFace Diffusers through 0.39.0 enables arbitrary file reads when a user or pipeline loads a maliciously crafted model. The `_get_checkpoint_shard_files` function in `hub_utils.py` blindly resolves `weight_map` shard filenames from model index JSON without validating for path separators or absolute paths, allowing an attacker who controls a model repository to escape the model directory and read any file accessible to the Diffusers process. No active exploitation confirmed (not in CISA KEV), but a public POC issue exists on GitHub and the attack surface includes the widely-used HuggingFace Hub ecosystem.