Diffusers vulnerabilities

A path traversal vulnerability was found in Diffusers up to version 0.39.0 in the _get_checkpoint_shard_files function. Attackers can supply malicious weight_map values in model index JSON, containing ../ sequences or absolute paths, allowing reading of safetensors files outside the intended directory.

A vulnerability in the Diffusers library before version 0.38.0 allows bypassing the trust_remote_code guard. The download() method validates model_index.json and custom pipeline code but later loads from a cached folder that can change, enabling execution of malicious .py code from a Hub repository without requiring trust_remote_code=True.

In diffusers prior to 0.38.0, the `_resolve_custom_pipeline_and_cls` function defaults `custom_pipeline` to `None.py`, allowing a malicious file from a Hugging Face Hub repository to be downloaded and executed during a standard `from_pretrained()` call. This bypasses the `trust_remote_code=True` safeguard, enabling silent remote code execution.

The Diffusers library before version 0.38.0 contains a vulnerability that bypasses the trust_remote_code protection. An attacker can execute arbitrary remote code even when trust_remote_code is set to False or omitted. The issue stems from a flawed implementation of the security check in the download() function, which can be bypassed through alternative code paths.