rules-diffusers

local_files_only=False (the default) causes from_pretrained() to fetch model weights from the HuggingFace Hub at runtime. In production inference environments this adds an uncontrolled external network dependency and bypasses any supply-chain review. FIX: Set local_files_only=True and pre-download approved model artifacts to an internal registry or filesystem.

RISK: Passing a user-controlled or concatenated path to save_pretrained() enables path traversal — an attacker can write model weights to arbitrary filesystem locations (CWE-22). FIX: Validate and canonicalize the output path against an allowlisted base directory before passing it to save_pretrained().

RISK: torch.load() on a .pt/.bin file uses Python's pickle protocol by default, enabling arbitrary code execution when loading a malicious checkpoint (CVE-2024-5480 and related). FIX: Use torch.load(..., weights_only=True) (PyTorch ≥ 2.0) or load from .safetensors format via from_pretrained() with the safetensors extra. Never load .pkl/.pt checkpoints from untrusted sources.

RISK: trust_remote_code=True allows the model card or pipeline to execute arbitrary Python code downloaded from a HuggingFace Hub repository at load time — a malicious or compromised model can achieve full RCE (CWE-94). FIX: Audit the model's modeling_*.py files before enabling this; prefer models that do not require it. Never enable in production inference servers.