diffusers: Hub repo with a None.py file executes code on a plain from_pretrained call

Impact

In diffusers 0.37.0 the custom-pipeline path interpolates an unset parameter into the literal filename None.py, so a Hub repository that ships such a file gets it downloaded and executed by an ordinary DiffusionPipeline.from_pretrained() call with no arguments - the trust_remote_code gate is bypassed because it only checks whether the caller passed custom_pipeline. On a GPU fleet this turns model pulling into code execution: any job, notebook or autoscaled worker that loads a third-party model identifier runs attacker code with that workload's identity, GPU access and mounted credentials. Where tenants share nodes or a model cache, one poisoned repository reference is enough to get a foothold on the node without the operator ever opting into remote code.

Who can reach it

The attacker publishes a public Hub repository; no credentials on the operator side. Exploitation requires a user, pipeline or scheduled job to call from_pretrained on that repository id - no trust_remote_code=True and no other flag needed.

What to do

Upgrade diffusers to 0.38.0 or later wherever models are loaded - training images, inference workers and notebook environments - and restart the affected processes. Pin model repositories to known revisions and restrict which Hub namespaces jobs may load from; there is no mitigation inside 0.37.0 short of blocking untrusted repository ids.

References

Related entries

• ChromaDB (SimpleRBAC): Authorization provider evaluates permissions incorrectlyCVE-2026-45831 · ChromaDB (SimpleRBAC)High
• ChromaDB (V1 endpoints): Tenant/database passed as `None` to the authz layerCVE-2026-45832 · ChromaDB (V1 endpoints)High
• ChromaDB: Authenticated code injectionCVE-2026-45833 · ChromaDBHigh
• LiteLLM (key generation): internal_user can mint keys with routes their role forbidsCVE-2026-47101 · LiteLLM (key generation)High
• LiteLLM (`/user/update`): User can self-elevate `user_role`CVE-2026-47102 · LiteLLM (`/user/update`)High
• vLLM (hardcoded `trust_remote_code=True`): Two model implementation files force remote code execution regardlessCVE-2026-4944 · vLLM (hardcoded `trust_remote_code=True`)High