Loading vulnerability…
CVE-2026-44513 is a code execution vulnerability in Hugging Face Diffusers affecting versions prior to 0.38.0. The flaw is caused by incorrect placement of the trust_remote_code enforcement in DiffusionPipeline.from_pretrained: the security gate was implemented inside DiffusionPipeline.download() rather than at the dynamic module loading site. As a result, code paths that bypassed or short-circuited download() could still reach dynamic loading of untrusted Python modules even when trust_remote_code was explicitly set to False or left at its default value.
The issue includes three related variants sharing the same root cause. In one variant, cross-repository custom pipeline loading evaluates the trust check against the primary repository while actually loading pipeline code from a different attacker-controlled repository via custom_pipeline, allowing untrusted pipeline code to execute. In a second variant, loading from a local snapshot bypasses the download() path entirely, so the trust gate is never reached before remote custom pipeline code is loaded. In a third variant, a local snapshot containing custom component Python modules referenced by model metadata can trigger execution of those component modules because the local-path flow similarly skips the trust check. The net effect is arbitrary code execution during model loading despite the caller attempting to disable remote code trust.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A set of related high-severity vulnerabilities in Hugging Face's diffusers library covering cross-repository pipeline loading, local snapshot bypasses, and malicious custom components, all enabling bypass of trust protections and arbitrary code execution from malicious model repositories.
A high-severity code injection vulnerability in Hugging Face Diffusers that bypasses trust_remote_code protections and permits arbitrary code execution through the custom_pipeline flow.
A high-severity set of trust check bypass variants in Hugging Face's diffusers library that can lead to arbitrary code execution during model loading, including from a local snapshot.
A related trust_remote_code bypass vulnerability in HuggingFace Diffusers caused by placing the security gate inside download() instead of at the dynamic module load site.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.