Diffusers: Remote Code Execution via Unsafely Loaded Custom Pipelines
Overview
The Diffusers library, a popular tool for working with pretrained diffusion models, contains a critical vulnerability (CVE-2026-44827) that allows for Remote Code Execution (RCE). Versions prior to 0.38.0 are affected. The vulnerability stems from improper handling of custom pipeline loading when a `custom_pipeline` parameter is not explicitly provided by the user during initialization of a `DiffusionPipeline`. In such cases, the library defaults `custom_pipeline` to `None`. The internal function `_resolve_custom_pipeline_and_cls` in `pipeline_loading_utils.py` performs string interpolation using f-strings, treating `None` as the literal string "None.py". If an attacker crafts a Hugging Face Hub repository containing a file named `None.py` which includes a malicious class inheriting from `DiffusionPipeline`, this file will be automatically downloaded and executed when a user calls `DiffusionPipeline.from_pretrained()` without specifying `trust_remote_code=True` or a `custom_pipeline`. The security safeguard `trust_remote_code` is bypassed because the check `custom_pipeline is not None` evaluates to false when the parameter was never passed, yet the vulnerable code path proceeds to load the "None.py" file. This enables silent RCE with minimal effort from the attacker, requiring only the victim to load a model from a compromised repository.
Affected Systems
Testing Guide
1. Ensure you have Diffusers version 0.37.0 installed. 2. Attempt to load a pipeline from a known benign repository without specifying `custom_pipeline` or `trust_remote_code`. ```python from diffusers import DiffusionPipeline pipeline = DiffusionPipeline.from_pretrained("runwayml/stable-diffusion-v1-5") ``` 3. If you are able to execute arbitrary code (e.g., by creating a dummy `None.py` file in a local directory that mimics a Hub repository structure and attempting to load from it, though this requires more setup to simulate the Hub environment), your installation might be vulnerable. 4. Verify the fix by upgrading to Diffusers 0.38.0 and repeating the test; successful execution of arbitrary code should no longer be possible.
Mitigation Steps
* Upgrade the Diffusers library to version 0.38.0 or later. * When loading pipelines from untrusted sources, always explicitly set `trust_remote_code=True` and review the code. However, this is not a complete solution for this specific vulnerability. * Carefully vet all Hugging Face Hub repositories from which you load models, especially custom pipelines. * Consider disabling automatic model downloading or implementing pre-download scanning for malicious code if operating in a highly sensitive environment.
Patch Details
Version 0.38.0