- Latest release
- 0.42.1 (Oct 27, 2026): no advisory affects it
- Newest unaffected release
- 0.42.1 (Oct 27, 2026), the latest release
- Advisories
- 3 · 3 high
- Weekly downloads
- 1.5M
- Dependents
- 404
- Releases
- 102 since 0.0.1 (May 30, 2022)
- Registry
- PyPI
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-45804Affects 0.0.1 to 0.37.1 (0.38.0 is outside it)
- CVE-2026-44827Affects 0.0.1 to 0.37.1 (0.38.0 is outside it)
- CVE-2026-44513Affects 0.0.1 to 0.37.1 (0.38.0 is outside it)
Advisories 3
- CVE-2026-45804High 7.5
Diffusers: TOCTOU Trust Remote Code Bypass
Affected: fixed in 0.38.0.
Fixed in 0.38.0 (released May 1, 2026, 75 days before disclosure).
The latest release, 0.42.1, is not affected.
- CVE-2026-44827High 8.8
Diffusers: None.py Trust Remote Code Bypass
Affected: fixed in 0.38.0.
Fixed in 0.38.0 (released May 1, 2026, 13 days before disclosure).
The latest release, 0.42.1, is not affected.
- CVE-2026-44513High 8.8
Diffusers: `trust_remote_code` bypass via `custom_pipeline` and local custom components
Affected: fixed in 0.38.0.
Fixed in 0.38.0 (released May 1, 2026, 13 days before disclosure).
The latest release, 0.42.1, is not affected.