Description
Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _get_checkpoint_shard_files function that allows attackers to read arbitrary files by supplying malicious weight_map values in model index JSON. Attackers can use ../ sequences or absolute paths in weight_map entries to escape the model directory and read safetensors files outside the intended location during model loading.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
huggingface diffusers
Default version status: unaffected
0 to ≤ 0.39.0affectedcee298c1f37c439a9a408396b8283a921238a1c6unaffected
pkg:pypi/diffusers