{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3ahuggingfacediffuserspython/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:huggingface:diffusers:*:*:*:*:*:python:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-44827"},{"cvss":7.5,"id":"CVE-2026-45804"},{"cvss":8.8,"id":"CVE-2026-44513"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["diffusers (\u003c 0.38.0)"],"_cs_severities":["high"],"_cs_tags":["toctou","rce","huggingface"],"_cs_type":"advisory","_cs_vendors":["Hugging Face"],"content_html":"\u003cp\u003eA TOCTOU vulnerability exists in the \u003ccode\u003ediffusers\u003c/code\u003e package (versions prior to 0.38.0), a library used for diffusion models. The vulnerability resides within the \u003ccode\u003eDiffusionPipeline.from_pretrained\u003c/code\u003e function, which is responsible for loading pipelines from the Hugging Face Hub. This function has a \u003ccode\u003etrust_remote_code\u003c/code\u003e guard intended to prevent the execution of untrusted code from custom pipelines. However, a race condition between two HTTP calls (\u003ccode\u003ehf_hub_download\u003c/code\u003e and \u003ccode\u003esnapshot_download\u003c/code\u003e) allows an attacker to introduce malicious code into the repository between the calls, effectively bypassing the trust check and enabling remote code execution. This occurs because the vulnerability allows arbitrary code to be loaded through the custom pipeline flow from a Hub repo, even without explicitly passing \u003ccode\u003ecustom_pipeline\u003c/code\u003e or \u003ccode\u003etrust_remote_code\u003c/code\u003e arguments.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker creates a Hugging Face Hub repository with a \u003ccode\u003emodel_index.json\u003c/code\u003e file containing a plain string \u003ccode\u003e_class_name\u003c/code\u003e value, indicating no custom pipeline code.\u003c/li\u003e\n\u003cli\u003eA user attempts to load the pipeline using \u003ccode\u003eDiffusionPipeline.from_pretrained(\u0026quot;attacker/repo\u0026quot;)\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ehf_hub_download\u003c/code\u003e function fetches the \u003ccode\u003emodel_index.json\u003c/code\u003e file (commit A) and the trust check passes because no custom pipeline is detected.\u003c/li\u003e\n\u003cli\u003eBefore the \u003ccode\u003esnapshot_download\u003c/code\u003e function is called, the attacker pushes a new commit (commit B) to the repository, modifying the \u003ccode\u003emodel_index.json\u003c/code\u003e file to use a list \u003ccode\u003e_class_name\u003c/code\u003e and adding a malicious \u003ccode\u003epipeline.py\u003c/code\u003e file.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003esnapshot_download\u003c/code\u003e function fetches commit B, including the malicious \u003ccode\u003epipeline.py\u003c/code\u003e file.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003e_resolve_custom_pipeline_and_cls\u003c/code\u003e function reads the updated \u003ccode\u003emodel_index.json\u003c/code\u003e and resolves the custom pipeline to the local path of the \u003ccode\u003epipeline.py\u003c/code\u003e file.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003e_get_pipeline_class\u003c/code\u003e function imports the malicious \u003ccode\u003epipeline.py\u003c/code\u003e file without any further trust checks.\u003c/li\u003e\n\u003cli\u003eThe malicious code within \u003ccode\u003epipeline.py\u003c/code\u003e is executed, resulting in arbitrary code execution on the user's machine.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an attacker to execute arbitrary code on the victim's machine. The vulnerability is a silent RCE meaning that the from_pretrained call succeeds and returns a fully functional pipeline even when malicious code has been injected. This could lead to data exfiltration, system compromise, or other malicious activities. The impact is significant as it undermines the trust mechanisms designed to protect users from running untrusted code.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to \u003ccode\u003ediffusers\u003c/code\u003e version 0.38.0 or later to patch the vulnerability.\u003c/li\u003e\n\u003cli\u003eWhen using \u003ccode\u003eDiffusionPipeline.from_pretrained\u003c/code\u003e, pin the \u003ccode\u003erevision\u003c/code\u003e argument to a specific commit hash to avoid race conditions, as described in the overview.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Detect Diffusers from_pretrained with trust_remote_code\u0026quot; to detect potential exploitation attempts by identifying calls to \u003ccode\u003eDiffusionPipeline.from_pretrained\u003c/code\u003e without explicit trust settings.\u003c/li\u003e\n\u003cli\u003eMonitor network connections for unexpected outbound traffic originating from processes associated with the \u003ccode\u003ediffusers\u003c/code\u003e library, using the network connection Sigma rule in this brief to identify potential command and control activity.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-03T07:59:13Z","date_published":"2026-05-20T15:32:30Z","id":"https://feed.craftedsignal.io/briefs/2026-05-diffusers-rce/","summary":"A Time-of-Check Time-of-Use (TOCTOU) vulnerability in the `diffusers` package allows arbitrary code execution via a race condition when loading pipelines from the Hugging Face Hub, bypassing trust checks.","title":"Diffusers TOCTOU Vulnerability Leads to Remote Code Execution","url":"https://feed.craftedsignal.io/briefs/2026-05-diffusers-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:huggingface:diffusers:*:*:*:*:*:python:*:*","version":"https://jsonfeed.org/version/1.1"}