Skip to content

CVE-2026-44827 Diffusers: None.py Trust Remote Code Bypass

HighCVSS 8.8 EPSS 0.72%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, diffusers 0.37.0 allows remote code execution without the trust_remote_code=True safeguard when loading pipelines from Hugging Face Hub repositories. The _resolve_custom_pipeline_and_cls function in pipeline_loading_utils.py performs string interpolation on the custom_pipeline parameter using f"{custom_pipeline}.py". When custom_pipeline is not supplied by the user, it defaults to None, which Python interpolates as the literal string "None.py". If an attacker publishes a Hub repository containing a file named None.py with a class that subclasses DiffusionPipeline, the file is automatically downloaded and executed during a standard DiffusionPipeline.from_pretrained() call with no additional keyword arguments. The trust_remote_code check in DiffusionPipeline.download() is bypassed because it evaluates custom_pipeline is not None as False (since the kwarg was never supplied), while the downstream code path that actually loads the module resolves the None value into a valid filename. An attacker can achieve silent arbitrary code execution by publishing a malicious model repository with a None.py file and a standard-looking model_index.json that references a legitimate pipeline class name, requiring only that a victim calls from_pretrained on the repository. This vulnerability is fixed in 0.38.0.

Affected products

ProductAffected versionsFixed in
pypi diffusers(PyPI) < 0.38.0 0.38.0
pypi diffusers(PyPI) = 0.0.1 No fix listed
pypi diffusers(PyPI) = 0.0.2 No fix listed
pypi diffusers(PyPI) = 0.0.3 No fix listed
pypi diffusers(PyPI) = 0.0.4 No fix listed
pypi diffusers(PyPI) = 0.1.0 No fix listed
pypi diffusers(PyPI) = 0.1.1 No fix listed
pypi diffusers(PyPI) = 0.1.2 No fix listed
pypi diffusers(PyPI) = 0.1.3 No fix listed
pypi diffusers(PyPI) = 0.10.0 No fix listed
pypi diffusers(PyPI) = 0.10.1 No fix listed
pypi diffusers(PyPI) = 0.10.2 No fix listed
pypi diffusers(PyPI) = 0.11.0 No fix listed
pypi diffusers(PyPI) = 0.11.1 No fix listed
pypi diffusers(PyPI) = 0.12.0 No fix listed
pypi diffusers(PyPI) = 0.12.1 No fix listed
pypi diffusers(PyPI) = 0.13.0 No fix listed
pypi diffusers(PyPI) = 0.13.1 No fix listed
pypi diffusers(PyPI) = 0.14.0 No fix listed
pypi diffusers(PyPI) = 0.15.0 No fix listed
pypi diffusers(PyPI) = 0.15.1 No fix listed
pypi diffusers(PyPI) = 0.16.0 No fix listed
pypi diffusers(PyPI) = 0.16.1 No fix listed
pypi diffusers(PyPI) = 0.17.0 No fix listed
pypi diffusers(PyPI) = 0.17.1 No fix listed
Show 89 more
ProductAffected versionsFixed in
pypi diffusers(PyPI) = 0.18.0 No fix listed
pypi diffusers(PyPI) = 0.18.1 No fix listed
pypi diffusers(PyPI) = 0.18.2 No fix listed
pypi diffusers(PyPI) = 0.19.0 No fix listed
pypi diffusers(PyPI) = 0.19.1 No fix listed
pypi diffusers(PyPI) = 0.19.2 No fix listed
pypi diffusers(PyPI) = 0.19.3 No fix listed
pypi diffusers(PyPI) = 0.2.0 No fix listed
pypi diffusers(PyPI) = 0.2.1 No fix listed
pypi diffusers(PyPI) = 0.2.2 No fix listed
pypi diffusers(PyPI) = 0.2.3 No fix listed
pypi diffusers(PyPI) = 0.2.4 No fix listed
pypi diffusers(PyPI) = 0.20.0 No fix listed
pypi diffusers(PyPI) = 0.20.1 No fix listed
pypi diffusers(PyPI) = 0.20.2 No fix listed
pypi diffusers(PyPI) = 0.21.0 No fix listed
pypi diffusers(PyPI) = 0.21.1 No fix listed
pypi diffusers(PyPI) = 0.21.2 No fix listed
pypi diffusers(PyPI) = 0.21.3 No fix listed
pypi diffusers(PyPI) = 0.21.4 No fix listed
pypi diffusers(PyPI) = 0.22.0 No fix listed
pypi diffusers(PyPI) = 0.22.1 No fix listed
pypi diffusers(PyPI) = 0.22.2 No fix listed
pypi diffusers(PyPI) = 0.22.3 No fix listed
pypi diffusers(PyPI) = 0.23.0 No fix listed
pypi diffusers(PyPI) = 0.23.1 No fix listed
pypi diffusers(PyPI) = 0.24.0 No fix listed
pypi diffusers(PyPI) = 0.25.0 No fix listed
pypi diffusers(PyPI) = 0.25.1 No fix listed
pypi diffusers(PyPI) = 0.26.0 No fix listed
pypi diffusers(PyPI) = 0.26.1 No fix listed
pypi diffusers(PyPI) = 0.26.2 No fix listed
pypi diffusers(PyPI) = 0.26.3 No fix listed
pypi diffusers(PyPI) = 0.27.0 No fix listed
pypi diffusers(PyPI) = 0.27.1 No fix listed
pypi diffusers(PyPI) = 0.27.2 No fix listed
pypi diffusers(PyPI) = 0.28.0 No fix listed
pypi diffusers(PyPI) = 0.28.1 No fix listed
pypi diffusers(PyPI) = 0.28.2 No fix listed
pypi diffusers(PyPI) = 0.29.0 No fix listed
pypi diffusers(PyPI) = 0.29.1 No fix listed
pypi diffusers(PyPI) = 0.29.2 No fix listed
pypi diffusers(PyPI) = 0.3.0 No fix listed
pypi diffusers(PyPI) = 0.30.0 No fix listed
pypi diffusers(PyPI) = 0.30.1 No fix listed
pypi diffusers(PyPI) = 0.30.2 No fix listed
pypi diffusers(PyPI) = 0.30.3 No fix listed
pypi diffusers(PyPI) = 0.31.0 No fix listed
pypi diffusers(PyPI) = 0.32.0 No fix listed
pypi diffusers(PyPI) = 0.32.1 No fix listed
pypi diffusers(PyPI) = 0.32.2 No fix listed
pypi diffusers(PyPI) = 0.33.0 No fix listed
pypi diffusers(PyPI) = 0.33.1 No fix listed
pypi diffusers(PyPI) = 0.34.0 No fix listed
pypi diffusers(PyPI) = 0.35.0 No fix listed
pypi diffusers(PyPI) = 0.35.1 No fix listed
pypi diffusers(PyPI) = 0.35.2 No fix listed
pypi diffusers(PyPI) = 0.36.0 No fix listed
pypi diffusers(PyPI) = 0.37.0 No fix listed
pypi diffusers(PyPI) = 0.37.1 No fix listed
pypi diffusers(PyPI) = 0.4.0 No fix listed
pypi diffusers(PyPI) = 0.4.1 No fix listed
pypi diffusers(PyPI) = 0.4.2 No fix listed
pypi diffusers(PyPI) = 0.5.0 No fix listed
pypi diffusers(PyPI) = 0.5.1 No fix listed
pypi diffusers(PyPI) = 0.6.0 No fix listed
pypi diffusers(PyPI) = 0.7.0 No fix listed
pypi diffusers(PyPI) = 0.7.1 No fix listed
pypi diffusers(PyPI) = 0.7.2 No fix listed
pypi diffusers(PyPI) = 0.8.0 No fix listed
pypi diffusers(PyPI) = 0.8.1 No fix listed
pypi diffusers(PyPI) = 0.9.0 No fix listed
huggingface diffusers = < 0.38.0 No fix listed
redhat/rhaii/vllm-cpu-rhel9:1789681128(Red Hat:ai_inference_server:3.4::el9) All versions No fix listed
redhat/rhaii/vllm-cuda-rhel9:1789681126(Red Hat:ai_inference_server:3.4::el9) All versions No fix listed
redhat/rhaii/vllm-cpu-rhel9:1790075793(Red Hat:ai_inference_server:3.4::el9) All versions No fix listed
redhat/rhaii/vllm-cuda-rhel9:1790090131(Red Hat:ai_inference_server:3.4::el9) All versions No fix listed
redhat/rhelai3/disk-image-cuda-rhel9:1790957417(Red Hat:enterprise_linux_ai:3.4::el9) All versions No fix listed
redhat/rhelai3/bootc-aws-cuda-rhel9:1790881122(Red Hat:enterprise_linux_ai:3.4::el9) All versions No fix listed
redhat/rhelai3/bootc-azure-cuda-rhel9:1790881120(Red Hat:enterprise_linux_ai:3.4::el9) All versions No fix listed
redhat/rhelai3/bootc-cuda-rhel9:1790868254(Red Hat:enterprise_linux_ai:3.4::el9) All versions No fix listed
redhat/rhelai3/bootc-gcp-cuda-rhel9:1790881123(Red Hat:enterprise_linux_ai:3.4::el9) All versions No fix listed
redhat/rhoai/odh-th06-cuda130-torch210-py312-rhel9:1787077779(Red Hat:openshift_ai:3.4::el9) All versions No fix listed
redhat/rhoai/odh-th06-rocm64-torch291-py312-rhel9:1787076481(Red Hat:openshift_ai:3.4::el9) All versions No fix listed
redhat/rhoai/odh-training-cuda128-torch29-py312-rhel9:1786611803(Red Hat:openshift_ai:3.4::el9) All versions No fix listed
redhat/rhoai/odh-training-rocm64-torch29-py312-rhel9:1786611435(Red Hat:openshift_ai:3.4::el9) All versions No fix listed
redhat/rhaiis/vllm-tpu-rhel9(Red Hat:ai_inference_server:3) All versions No fix listed
redhat/rhoai/odh-openvino-model-server-rhel9(Red Hat:openshift_ai) All versions No fix listed
huggingface diffusers < 0.38.0 0.38.0

References