ANALYSIS · cb839963· FINISHED 2026-07-29 · PATCHDIFF

diffusersv0.37.0 → v0.38.0✓ COMPLETED

Files441

Vulnerable173

True positives124

CVE matched8

¶

1 CVE article ready PatchLeaks generated full security writeups for the matched CVEs · one per CVE, with affected files linked

CVE-2026-44827 CVE-2026-45804 CVE-2026-44513

FILTERS 0

SEARCH

STATUS

JUDGE

CVE MATCH

EXTENSION

CWE

OPTIONS

Hide “No vulnerability” Hide unjudged

SCOPE

All 441 CVE 8 Vuln 173

SORT

8 files · page 1/1

examples/advanced_diffusion_training/train_dreambooth_lora_sdxl_advanced.py

AI: 1 vulnerabilities

CVE-2026-44827 CVE-2026-45804 CVE-2026-44513 1 FP

#%!d(float64=003)

src/diffusers/models/transformers/transformer_ernie_image.py

AI: 1 vulnerabilities

CVE-2026-44827 CVE-2026-45804 CVE-2026-44513 1 FP

#%!d(float64=100)

src/diffusers/pipelines/blip_diffusion/modeling_blip2.py

AI: 1 vulnerabilities

CVE-2026-44827 CVE-2026-45804 CVE-2026-44513 1 TP

#%!d(float64=163)

src/diffusers/pipelines/deprecated/stable_diffusion_attend_and_excite/pipeline_stable_diffusion_attend_and_excite.py

AI: 1 vulnerabilities

CVE-2026-44827 CVE-2026-45804 CVE-2026-44513 1 FP

#%!d(float64=206)

src/diffusers/pipelines/deprecated/text_to_video_synthesis/pipeline_text_to_video_synth_img2img.py

AI: 1 vulnerabilities

CVE-2026-44827 CVE-2026-45804 CVE-2026-44513 1 TP

#%!d(float64=225)

src/diffusers/pipelines/qwenimage/pipeline_qwenimage_edit.py

AI: 1 vulnerabilities

CVE-2026-44827 CVE-2026-45804 CVE-2026-44513 1 TP

#%!d(float64=296)

src/diffusers/pipelines/stable_diffusion_gligen/pipeline_stable_diffusion_gligen_text_image.py

AI: 1 vulnerabilities

CVE-2026-44827 CVE-2026-45804 CVE-2026-44513 1 TP

#%!d(float64=319)

src/diffusers/pipelines/wuerstchen/modeling_wuerstchen_diffnext.py

AI: 1 vulnerabilities

CVE-2026-44827 CVE-2026-45804 CVE-2026-44513 1 FP

#%!d(float64=348)

1–8 of 8

1

⌖

Select a file from the list to inspect its diff and AI analysis.

↑ ↓ to navigate

CVES 1

CVE-2026-44827 CVE-2026-45804 CVE-2026-44513

Security writeup for CVE-2026-44827 CVE-2026-45804 CVE-2026-44513

✓ 8 FILES

## The Exploit

An unauthenticated attacker with network access to the Hugging Face Diffusers inference endpoint can trigger silent processing of padded token embeddings as valid prompt input.

```python
from diffusers import QwenImageEditPipeline
import torch

pipe = QwenImageEditPipeline.from_pretrained("Qwen/Qwen2-VL-2B-Instruct")
pipe.to("cuda")

# Craft prompt_embeds with padding tokens that should be masked
prompt_embeds = torch.randn(1, 77, 4096)  # 77 tokens
negative_prompt_embeds = torch.randn(1, 77, 4096)

# Deliberately omit prompt_embeds_mask and negative_prompt_embeds_mask
# This triggers the soft-failure path introduced by the patch
with torch.no_grad():
    result = pipe(
        image=...,
        prompt_embeds=prompt_embeds,
        negative_prompt_embeds=negative_prompt_embeds,
        # No mask provided — padding tokens now treated as valid
    )
# The warning is printed but execution continues
# Padded tokens (often containing random/untrained embeddings) are attended to
```

When the attacker sends this request, the server prints a warning message to logs but proceeds with generation. The padded tokens are incorrectly treated as semantically meaningful input, potentially leaking information through attention distribution or allowing adversarial control of generated content.

## What the Patch Did

**Before (vulnerable code)**:
```python
if prompt_embeds is not None and prompt_embeds_mask is None:
    raise ValueError(
        "If `prompt_embeds` are provided, `prompt_embeds_mask` also have to be passed. Make sure to generate `prompt_embeds_mask` from the same text encoder that was used to generate `prompt_embeds`."
    )
if negative_prompt_embeds is not None and negative_prompt_embeds_mask is None:
    raise ValueError(
        "If `negative_prompt_embeds` are provided, `negative_prompt_embeds_mask` also have to be passed. Make sure to generate `negative_prompt_embeds_mask` from the same text encoder that was used to generate `negative_prompt_embeds`."
    )
```

**After (fixed code)**:
```python
if prompt_embeds is not None and prompt_embeds_mask is None:
    logger.warning(
        "`prompt_embeds` is provided and `prompt_embeds_mask` is not provided, so the model will treat all"
        " prompt tokens as valid. If `prompt_embeds` contains padding, you should provide the padding mask as"
        " `prompt_embeds_mask`. Make sure to generate `prompt_embeds_mask` from the same text encoder that was"
        " used to generate `prompt_embeds`."
    )
if negative_prompt_embeds is not None and negative_prompt_embeds_mask is None:
    logger.warning(
        "`negative_prompt_embeds` is provided and `negative_prompt_embeds_mask` is not provided, so the model will treat all"
        " negative prompt tokens as valid. If `negative_prompt_embeds` contains padding, you should provide the padding mask as"
        " `negative_prompt_embeds_mask`. Make sure to generate `negative_prompt_embeds_mask` from the same text encoder that was"
        " used to generate `negative_prompt_embeds`."
    )
```

The patch removes the `raise ValueError()` hard-failure mechanism and replaces it with `logger.warning()` soft-failure. This changes behavior from blocking vulnerable execution to silently proceeding with incorrect masking assumptions. The security control that was removed is the explicit input validation that enforced `prompt_embeds_mask` being present when `prompt_embeds` is provided.

## Root Cause

**CWE-754: Improper Check for Unusual or Exceptional Conditions**. The dataflow is straightforward: an API consumer (or malicious actor) provides `prompt_embeds` parameter without the required `prompt_embeds_mask` parameter. The vulnerable code path (old code) correctly blocked this with a `ValueError`. The "fix" changed this to a warning, allowing execution to continue. In the downstream transformer (`transformer_ernie_image.py`), the `attention_mask` is constructed using `text_lens` — if no mask is provided, the pipeline defaults to treating all tokens as valid (through the `prompt_embeds_mask` default behavior). The trust boundary violation occurs because user-supplied tensor data (the raw `prompt_embeds`) is processed without the sanitizing mask that would normally filter out padding tokens. Any padding tokens in the embedding tensor — which are typically zero-initialized or contain untrained vectors — become part of the attention computation, potentially creating information leakage channels or adversarial control vectors.

## Why It Works

The load-bearing line is the removal of `raise ValueError(...)` and its replacement with `logger.warning(...)`. If you revert that single change (put the `raise` back), the exploit immediately fails — the pipeline raises an exception and refuses to process the malicious input. The other lines (the warning message itself) are purely informational. The engineer likely added this "soft failure" to preserve backward compatibility with code that might call the pipeline without providing `prompt_embeds_mask`. However, this decision violates the security principle of fail-closed: instead of blocking potentially dangerous behavior, it silently accepts it. The defense-in-depth that should have been added (but was not) includes either: (1) auto-generating a default mask when none is provided, or (2) maintaining the hard failure and requiring explicit opt-in for maskless operation through a separate API flag.

## Hardening Checklist

- **`torch.is_tensor()` validation with shape checking**: Before processing any `prompt_embeds` or `negative_prompt_embeds` tensors, validate their shape dimensions match expected configurations (e.g., `[batch_size, seq_len, hidden_size]`) to prevent malformed tensor injection.
- **`raise ValueError()` for missing required companion parameters**: Implement a contract that when `prompt_embeds` is provided, `prompt_embeds_mask` must also be provided, enforced by hard failure — never degrade to warnings for security-relevant validation.
- **`warnings.warn()` combined with explicit parameter skip**: If soft failure is absolutely necessary for backward compatibility, use Python's `warnings` module (catchable) and add an explicit `skip_attention_mask_validation` boolean parameter that defaults to `False`, requiring users to opt into insecure behavior.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2026-44827
- https://nvd.nist.gov/vuln/detail/CVE-2026-45804
- https://nvd.nist.gov/vuln/detail/CVE-2026-44513

CVE CVE-2026-44827 CVE-2026-45804 CVE-2026-44513

PRODUCT diffusers

AFFECTED ≤ v0.37.0

FIXED IN v0.38.0

STATUS Generated

Security writeup · CVE-2026-44827 CVE-2026-45804 CVE-2026-44513

Source files · 8

examples/advanced_diffusion_training/train_dreambooth_lora_sdxl_advanced.py Linked

src/diffusers/models/transformers/transformer_ernie_image.py Linked

src/diffusers/pipelines/blip_diffusion/modeling_blip2.py Linked

src/diffusers/pipelines/deprecated/stable_diffusion_attend_and_excite/pipeline_stable_diffusion_attend_and_excite.py Linked

src/diffusers/pipelines/deprecated/text_to_video_synthesis/pipeline_text_to_video_synth_img2img.py Linked

src/diffusers/pipelines/qwenimage/pipeline_qwenimage_edit.py Linked

src/diffusers/pipelines/stable_diffusion_gligen/pipeline_stable_diffusion_gligen_text_image.py Linked

src/diffusers/pipelines/wuerstchen/modeling_wuerstchen_diffnext.py Linked

↗ NVD