Repository navigation
Security: huggingface/diffusers
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
RCE: a module name from a model repo's own config reaches importlib on from_pretrained(), with trust_remote_code=FalseGHSA-4prv-5hj7-c2xr published
Oct 27, 2026 by DN6High -
`trust_remote_code` bypass via `custom_pipeline` and local custom componentsGHSA-98h9-4798-4q5v published
May 1, 2026 by DN6High -
TOCTOU Trust Remote Code BypassGHSA-7wx4-6vff-v64p published
May 20, 2026 by DN6High -
None.py Trust Remote Code BypassGHSA-j7w6-vpvq-j3gm published
May 1, 2026 by DN6High