The vulnerability in huggingface diffusers (CVE-2026-45804) is a time-of-check to time-of-use (TOCTOU) race condition in the DiffusionPipeline.from_pretrained flow. The download() function validates model_index.json and custom pipeline code before loading from a cached folder that can be changed, enabling a malicious Hub repository with custom .py pipeline code to execute without requiring the custom_pipeline or trust_remote_code=True flags. This allows unauthorized code execution through the custom pipeline flow. The issue is resolved in version 0.38.0.

An attacker controlling a Hub repository can execute arbitrary Python code through the custom pipeline mechanism without explicit user consent (i.e., without setting trust_remote_code=True). This leads to high confidentiality, integrity, and availability impacts as indicated by the CVSS score of 7.5.

Upgrade huggingface diffusers to version 0.38.0 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are indicated. Users should avoid using affected versions prior to 0.38.0 to prevent exploitation.