diffusers@0.37.1

State-of-the-art diffusion in PyTorch and JAX.

latest version

0.38.0

first published

3 years ago

latest version published

13 days ago

licenses detected

Apache-2.0
[0,)

View diffusers package health on Snyk (opens in a new tab)

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the diffusers package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
H Arbitrary Code Injection diffusers is a State-of-the-art diffusion in PyTorch and JAX. Affected versions of this package are vulnerable to Arbitrary Code Injection in the `from_pretrained` fucntion when a repository contains a `None.py` file and the `custom_pipeline` argument is not supplied. An attacker can execute arbitrary code by uploading a malicious `None.py` file to a model repository and convincing a user to load the model without specifying `custom_pipeline` or `trust_remote_code` arguments. How to fix Arbitrary Code Injection? Upgrade `diffusers` to version 0.38.0 or higher.	[,0.38.0)
H Deserialization of Untrusted Data diffusers is a State-of-the-art diffusion in PyTorch and JAX. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the `parsing` process. An attacker can execute arbitrary code by providing specially crafted data that is deserialized without proper validation when a user opens a malicious file or visits a malicious page. Note: The vendor confirmed that no changes will be made and closed the report as informative. How to fix Deserialization of Untrusted Data? There is no fixed version for `diffusers`.	[0,)

Arbitrary Code Injection

diffusers is a State-of-the-art diffusion in PyTorch and JAX.

Affected versions of this package are vulnerable to Arbitrary Code Injection in the from_pretrained fucntion when a repository contains a None.py file and the custom_pipeline argument is not supplied. An attacker can execute arbitrary code by uploading a malicious None.py file to a model repository and convincing a user to load the model without specifying custom_pipeline or trust_remote_code arguments.

How to fix Arbitrary Code Injection?

Upgrade diffusers to version 0.38.0 or higher.

[,0.38.0)

Deserialization of Untrusted Data

diffusers is a State-of-the-art diffusion in PyTorch and JAX.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the parsing process. An attacker can execute arbitrary code by providing specially crafted data that is deserialized without proper validation when a user opens a malicious file or visits a malicious page.

Note:

The vendor confirmed that no changes will be made and closed the report as informative.

How to fix Deserialization of Untrusted Data?

There is no fixed version for diffusers.

[0,)

Go back to all versions of this package