Homepage

diffusers@0.39.0

State-of-the-art diffusion in PyTorch and JAX.

  • latest version

    0.39.0

  • first published

    4 years ago

  • latest version published

    28 days ago

  • licenses detected

  • View diffusers package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the diffusers package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Directory Traversal

    diffusers is a State-of-the-art diffusion in PyTorch and JAX.

    Affected versions of this package are vulnerable to Directory Traversal via the _get_checkpoint_shard_files function. An attacker can access arbitrary files by providing crafted weight_map values containing directory traversal sequences or absolute paths in a model index JSON during model loading.

    How to fix Directory Traversal?

    A fix was pushed into the master branch but not yet published.

    [0,)
    • H
    Deserialization of Untrusted Data

    diffusers is a State-of-the-art diffusion in PyTorch and JAX.

    Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the parsing process. An attacker can execute arbitrary code by providing specially crafted data that is deserialized without proper validation when a user opens a malicious file or visits a malicious page.

    Note:

    The vendor confirmed that no changes will be made and closed the report as informative.

    How to fix Deserialization of Untrusted Data?

    There is no fixed version for diffusers.

    [0,)
    Go back to all versions of this package