Huggingface Diffusers
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Huggingface Diffusers.
By the Year
In 2026 there have been 1 vulnerability in Huggingface Diffusers with an average score of 4.3 out of ten.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 1 | 4.30 |
It may take a day or so for new Diffusers vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Huggingface Diffusers Security Vulnerabilities
Diffusers 0.39.0 Path Traversal via weight_map in _get_checkpoint_shard_files
CVE-2026-65920
4.3 - Medium
- July 23, 2026
Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _get_checkpoint_shard_files function that allows attackers to read arbitrary files by supplying malicious weight_map values in model index JSON. Attackers can use ../ sequences or absolute paths in weight_map entries to escape the model directory and read safetensors files outside the intended location during model loading.
Directory traversal
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Huggingface Diffusers or by Huggingface? Click the Watch button to subscribe.
