gcdRadar
archive/Patch now/AIR-2026-0622
closedclosed 7 May 2026Patch now2 Disclosed vulnerabilityAI

Hugging Face Diffusers custom pipeline trust_remote_code bypass vulnerability

Diffusers

A bypass in Hugging Face Diffusers pipeline loading enables arbitrary code execution when utilizing malicious model repositories. The loader incorrectly handles custom pipeline configuration arguments.

disclosed CVENo confirmed exploitation, so this record is tracked as a disclosed vulnerability and not counted as an incident. It moves into the counts if CISA or the vendor confirms exploitation. Why

CVSS
8.8
EPSS
0.01 · top 46% · 2026-11-13
EPSS scores by FIRST
fix status
Fix status unknown
first report
7 May 2026
last update
7 May 2026
CVE ids
CVE-2026-44827other records

Timeline · 1

  1. 7 May 2026CVE-2026-44827: Diffusers has a `trust_remote_code` bypass via `custom_pipeline` and local custom components

Sources · 1

Advisories and databases

  1. 2026-05-07
    CVE-2026-44827: Diffusers has a `trust_remote_code` bypass via `custom_pipeline` and local custom components
    GitHub Advisory Database · github.com/advisories/GHSA-j7w6-vpvq-j3gm

Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.

Classification

lane
Patch now
AI role
Attack on AI
categories
Infrastructure vulnerabilitySupply chain
severity
2 · Disclosed vulnerability
fix status
Fix status unknown
targets
Framework / tooling
owasp llm top 10
LLM03:2025 Supply Chain
mitre atlas
AML.T0010 AI Supply Chain Compromise
tags
diffusersrcetrust-remote-code
dates
happened 7 May 2026 · first reported 7 May 2026
origin
GitHub Advisory Database
Vulnerability record from NVD / the GitHub Advisory Database. This product uses the NVD API but is not endorsed or certified by the NVD.
record
confidence 0.95 · created 2026-10-18 07:00Z · updated 2026-10-18 07:00Z

Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned

Copy a brief

This record as a short Markdown brief, for a ticket, a chat or a coding agent.

the brief as text
# Hugging Face Diffusers custom pipeline trust_remote_code bypass vulnerability

https://gcdradar.vercel.app/incidents/hugging-face-diffusers-custom-pipeline-trust-remote-code-byp · AIR-2026-0622 · closed 2026-05-07

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-05-07
- AI role: Attack on AI
- Products: Diffusers
- CVE ids: CVE-2026-44827
- CVSS: 8.8

## Summary

A bypass in Hugging Face Diffusers pipeline loading enables arbitrary code execution when utilizing malicious model repositories. The loader incorrectly handles custom pipeline configuration arguments.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-05-07: CVE-2026-44827: Diffusers has a `trust_remote_code` bypass via `custom_pipeline` and local custom components (https://github.com/advisories/GHSA-j7w6-vpvq-j3gm)

## Sources

- 2026-05-07 GitHub Advisory Database: CVE-2026-44827: Diffusers has a `trust_remote_code` bypass via `custom_pipeline` and local custom components https://github.com/advisories/GHSA-j7w6-vpvq-j3gm

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.

Related

  1. closed8.8
    Hugging Face libraries Hugging Face Diffusers trust_remote_code bypass allows remote code execution

    Patch now · Disclosed · since 7 May 2026 · CVE-2026-44513

    AI
  2. closed8.8
    vLLM vLLM Hardcoded Trust Remote Code Parameter Leads to RCE

    Patch now · Disclosed · since 28 May 2026 · CVE-2026-4944

    AI
  3. closed8.8
    vLLM CVE-2026-5817: Docker Model Runner vllm-metal arbitrary code execution vulnerability

    Patch now · Disclosed · since 22 May 2026 · CVE-2026-5817

    AI
  4. closed9.8
    Guardrails AI CVE-2026-31233: Guardrails AI code injection in Hub installer

    Supply chain · Disclosed · since 12 May 2026 · CVE-2026-31233

    AI
  5. closed8.2
    LangChain family CVE-2026-44843: LangChain vulnerable to unsafe deserialization

    Patch now · Disclosed · since 8 May 2026 · updated 26 May 2026 · CVE-2026-44843

    AI
  6. closed8.8
    Langflow IBM Langflow Desktop Insecure Deserialization Vulnerability

    Patch now · Disclosed · since 8 Apr 2026 · CVE-2026-3357

    AI