The vulnerability in huggingface diffusers before 0.38.0 arises because the trust_remote_code security check is performed inside DiffusionPipeline.download() rather than at the actual dynamic module loading point. This design flaw allows attackers to bypass the check by using alternative code paths that do not invoke download(), such as specifying a custom_pipeline from a malicious repository or loading local snapshots with custom component files. As a result, arbitrary remote code can be executed even when trust_remote_code is set to false. The issue has three variants sharing this root cause. The vulnerability is addressed in version 0.38.0.

Successful exploitation allows an attacker to execute arbitrary remote code on the system running the vulnerable diffusers library, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The CVSS 3.1 score is 8.8 (high severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

This vulnerability is fixed in diffusers version 0.38.0. Users should upgrade to version 0.38.0 or later to remediate this issue. There is no vendor advisory indicating alternative mitigations or that no action is required. Patch status is confirmed by the versioning information in the description. No cloud service is involved, so remediation is the responsibility of the user.