Diffusers, a library for pretrained diffusion models, has a trust_remote_code bypass that permits arbitrary remote code execution when using DiffusionPipeline.from_pretrained. Even when trust_remote_code=False is set or omitted, code from untrusted pipelines or local custom components can be loaded and executed. The issue occurs because the security check was placed inside a download routine rather than at the dynamic-module loading site, allowing the gate to be bypassed via custom_pipeline or local snapshots. This flaw is classified as CWE‑94, indicating code injection through dynamic code loading.

This vulnerability affects the Hugging Face Diffusers library for any version before 0.38.0. Users who load pipelines from external repositories or local snapshots that reference custom components—particularly those specifying a custom_pipeline argument or containing untrusted Python modules—are exposed. The weakness operates regardless of whether the source is remote or local, impacting all deployments that have not applied the 0.38.0 fix.

The flaw carries a CVSS score of 8.8, denoting a high severity level and a significant potential impact on confidentiality, integrity, and availability via remote code execution. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting no mass exploitation is currently documented. Nonetheless, the attack vector can be exercised by merely specifying a malicious custom_pipeline or loading a local snapshot with untrusted scripts, a path that requires no special privileges and can be triggered by any user invoking from_pretrained.