High [CVE-2026-45804] Arbitrary code execution due to trust_remote_code guard bypass

Diffusers is the a library for pretrained diffusion models.

Prior to 0.38.0, Diffusers' DiffusionPipeline.from_pretrained flow can bypass the trust_remote_code guard because download() validates model_index.json and custom pipeline code before later loading from a cached folder that can change, allowing a Hub repository with custom.py pipeline code to execute through the custom pipeline flow without passing custom_pipeline or trust_remote_code=True.

This issue is fixed in version 0.38.0. A remote attacker could exploit this vulnerability by crafting a malicious Hub repository with custom Python pipeline code.

The `DiffusionPipeline.from_pretrained` flow can bypass the `trust_remote_code` security mechanism, allowing the execution of arbitrary code on the system when a user interacts with the malicious repository. This could lead to high impact on confidentiality, integrity, and availability of the affected system.

This Important flaw in Diffusers, as used in Red Hat AI Inference Server, Red Hat OpenShift AI, and Red Hat Enterprise Linux AI, allows for arbitrary code execution. A remote attacker could exploit this by convincing a user to load a specially crafted model from a malicious Hub repository, bypassing the `trust_remote_code` safeguard.

This could lead to a complete compromise of the system where the model is loaded.