A critical code injection vulnerability in the Hugging Face Diffusers library allows for potential remote code execution by an attacker.

This is a CWE-94 (Improper Control of Generation of Code) vulnerability. The library fails to properly sanitize input, enabling an attacker to inject and execute arbitrary code within the context of the application.

Exploitation of this vulnerability allows for arbitrary code execution, which can lead to unauthorized data access, system manipulation, or complete control over the host running the diffusion models. With a CVSS score of 8.8, the potential for severe operational and security impact is high.

Immediate Action: Update the diffusers package to version 0.38.0 or later.

Proactive Monitoring: Review application execution logs for signs of unexpected code execution or unauthorized model loading patterns.

Compensating Controls: Run the application with the principle of least privilege, ensuring the process account has minimal access to the underlying system and sensitive data.

Public Exploit Available: Unknown

Immediate patching to version 0.38.0 is essential to neutralize this threat. Ensure that all downstream dependencies are also updated and audit any custom code that interacts with the Diffusers library to ensure no secondary injection vectors exist.