CVE-2026-45804

Executive Summary

CVE-2026-45804 is a critical security vulnerability in the Diffusers library, a widely used Python package for pretrained diffusion models. The flaw resides in the DiffusionPipeline.from_pretrained flow, where a Time-of-Check Time-of-Use (TOCTOU) race condition allows an attacker to bypass the trust_remote_code guard. By exploiting a window between validation and loading from a cached folder, a malicious Hub repository can execute arbitrary Python code without requiring custom_pipeline or trust_remote_code=True. This vulnerability has a CVSS score of 7.5 (High) and affects all versions prior to 0.38.0. No public proof-of-concept (PoC) or exploit code is currently available, but the attack vector is well-defined.

Supply Chain & Package Security

This vulnerability is specific to the PyPI ecosystem, as Diffusers is distributed via PyPI. The attack exploits the Hugging Face Hub's model distribution mechanism, making it a supply chain risk. Organizations using Diffusers in automated pipelines or CI/CD environments are particularly vulnerable, as the attack can be triggered by simply loading a model from a malicious repository.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Arbitrary code execution can lead to data exfiltration.
• Integrity Impact: High (I:H) – Code execution can modify system state.
• Availability Impact: High (A:H) – Code execution can disrupt services.

Deep Dive & Mechanics

The vulnerability is a classic TOCTOU (Time-of-Check Time-of-Use) race condition. The DiffusionPipeline.from_pretrained method performs the following steps:

1. Validation: It downloads and validates model_index.json and any custom pipeline code from the Hugging Face Hub repository.
2. Caching: The validated files are stored in a local cache directory.
3. Loading: The pipeline is loaded from the cached folder.

The flaw is that between steps 2 and 3, an attacker can modify the contents of the cached folder (e.g., by exploiting a race condition or by having write access to the cache). This allows a malicious repository to initially pass validation with benign code, then swap in malicious .py files in the cache before loading. The trust_remote_code guard is bypassed because the validation step does not re-check the cache after the initial download.

The attack does not require custom_pipeline or trust_remote_code=True because the custom pipeline flow is triggered automatically when the repository contains a pipeline.py file, and the validation is only performed once.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 0.38.0):

# Simplified vulnerable flow
def from_pretrained(self, repo_id, **kwargs):
    # Step 1: Download and validate
    model_index = download_and_validate(repo_id)
    # Step 2: Cache the files
    cache_path = cache_files(repo_id, model_index)
    # Step 3: Load from cache (TOCTOU window)
    pipeline = load_from_cache(cache_path)
    return pipeline

Patched Code (0.38.0 and later):

# Simplified patched flow
def from_pretrained(self, repo_id, **kwargs):
    # Step 1: Download and validate
    model_index = download_and_validate(repo_id)
    # Step 2: Cache the files
    cache_path = cache_files(repo_id, model_index)
    # Step 3: Re-validate cache before loading
    re_validate_cache(cache_path, model_index)
    pipeline = load_from_cache(cache_path)
    return pipeline

The patch adds a re-validation step after caching to ensure the files have not been tampered with.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Hugging Face Hub account.
• Ability to create a repository with a custom pipeline.

Attack Steps:

1. Create a malicious Hugging Face Hub repository with a model_index.json that points to a benign pipeline.py.
2. After the victim's system downloads and caches the files, quickly modify the repository to replace pipeline.py with malicious code.
3. The victim's system loads the malicious code from the cache, executing arbitrary Python.

Lab Setup:

# Victim machine
pip install diffusers==0.37.0
python -c "from diffusers import DiffusionPipeline; pipe = DiffusionPipeline.from_pretrained('attacker/malicious-repo')"

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection:

• Monitor for unexpected Hugging Face Hub repository downloads.
• Use file integrity monitoring on the Diffusers cache directory (typically ~/.cache/huggingface/diffusers).
• Enable audit logging on the Hugging Face Hub API.

Hunting:

• Search for DiffusionPipeline.from_pretrained calls in codebases.
• Check for recent modifications to pipeline.py files in the cache.

Indicators of Compromise (IOCs)

• File Hashes: (None available, but monitor for unknown .py files in the cache)
• Network Indicators:
  • Outbound connections to huggingface.co or huggingfacehub.co from unexpected processes.
  • Unusual API calls to the Hugging Face Hub.
• Process Indicators:
  • Python processes loading custom pipeline code without trust_remote_code=True.
• Registry/File System:
  • Unexpected .py files in ~/.cache/huggingface/diffusers/.
  • Modified model_index.json files in the cache.

Detection Engineering

YARA Rule

rule CVE_2026_45804_Diffusers_TOCTOU {
    meta:
        description = "Detects potential exploitation of CVE-2026-45804 in Diffusers"
        author = "Valters IT"
        date = "2025-04-14"
        hash = "unknown"
    strings:
        $s1 = "from_pretrained" ascii wide nocase
        $s2 = "trust_remote_code" ascii wide nocase
        $s3 = "custom_pipeline" ascii wide nocase
    condition:
        all of ($s*) and filesize < 10KB
}

Sigma Rule

title: CVE-2026-45804 Diffusers TOCTOU Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2026-45804 in Diffusers
author: Valters IT
date: 2025-04-14
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/python3'
        CommandLine|contains: 'DiffusionPipeline.from_pretrained'
    condition: selection
falsepositives:
    - Legitimate use of Diffusers with trusted repositories
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-45804 Diffusers TOCTOU Exploitation";
    flow:to_server,established;
    content:"huggingface.co"; http_host;
    content:"/models/"; http_uri;
    content:".py"; http_uri;
    classtype:attempted-user;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate:

• Upgrade Diffusers to version 0.38.0 or later.
• If upgrade is not possible, restrict network access to the Hugging Face Hub.
• Use a proxy to inspect and validate all downloaded model files.

Long-term:

• Implement file integrity monitoring on the Diffusers cache.
• Use containerization to isolate model loading processes.
• Regularly audit Hugging Face Hub repositories for malicious content.

Workaround:

• Manually download and validate model files before loading them with from_pretrained.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert