CVE-2026-44827
Code injection in Huggingface Diffusers
CVSS score
8.8
EPSS probability
%0.7
Risk score
0.1
Published
5 mo ago
Related Security News
Articles and analysis bulletins in which the press and security publications have covered this vulnerability:
Hugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Code
Three high-severity security flaws have been disclosed in Hugging Face's Diffusers library that could allow crafted model repositories to stealthily execute arbitrary code on machines that load it, opening the artificial intelligence (AI) supply chain to security risk. "These vulnerabilities are bypassing trust_remote_code, the safeguard designed to stop unreviewed code from running in the
Similar Vulnerabilities
9.8
CVE-2026-25874Deserialization of untrusted data in Huggingface Lerobot
Patch verified Public Exploits:3EPSS %1
8.0
7.8
CVE-2026-4372Deserialization of untrusted data in Huggingface Transformers
Patch verified Public Exploits:1EPSS %1
7.5
CVE-2025-6921Uncontrolled resource consumption in Huggingface Transformers
Patch verified Public Exploits:11EPSS %1
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-44827"