Diffusers is a library for pretrained diffusion models. Prior to 0.38.0, the DiffusionPipeline.from_pretrained flow bypasses the trust_remote_code guard because the download() step validates model_index.json and any custom pipeline code, but a subsequent load from a cached folder can overwrite those files. This allows an attacker to host a repository containing malicious .py pipeline code that is executed when the custom pipeline flow is used without specifying custom_pipeline or trust_remote_code=True, resulting in remote code execution. The flaw is a classic time‑of‑check to time‑of‑use race that enables uncontrolled code execution.

Huggingface Diffusers library before version 0.38.0. Any instance that loads custom pipelines from the Huggingface Hub without explicitly enabling trust_remote_code or providing a custom_pipeline path will be vulnerable.

The CVSS score of 7.5 indicates a high severity. The EPSS score of less than 1% shows low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote: an attacker hosts a malicious repository on the Huggingface Hub, causes a user to download and load its custom pipeline, and thereby injects executable code. Exploitation requires an environment that follows the default DiffusionPipeline.from_pretrained flow without additional safeguards.