Hi, and thanks for publishing MeiGen-AI/OPSD-V. While looking at how recently released Python projects pin their dependencies, I found that one of the exact pins in this repository resolves to releases that OSV reports as affected by published advisories.
These are advisories in upstream packages, not in your code, and I have not checked whether the affected code paths are reachable from this project. Please treat this as information rather than a confirmed exploit path.
What was found
| Manifest |
Pin |
Advisories |
Highest severity |
Current release |
requirements.txt |
diffusers==0.31.0 |
3 |
HIGH |
0.39.0 |
Details
diffusers==0.31.0 in requirements.txt
- GHSA-7wx4-6vff-v64p (HIGH): Diffusers: TOCTOU Trust Remote Code Bypass (fixed in 0.38.0)
- GHSA-98h9-4798-4q5v (HIGH): Diffusers has a
trust_remote_code bypass via custom_pipeline and local custom components (fixed in 0.38.0)
- PYSEC-2026-41 (unspecified severity) (fixed in 0.38.0)
diffusers==0.39.0 is the current release on PyPI, and querying OSV for that exact version returns no advisories.
Suggested change
-diffusers==0.31.0
+diffusers==0.39.0
I have not verified that these upgrades are compatible with this project, and in a machine-learning stack the pinned versions may be deliberate for CUDA, driver, or checkpoint compatibility. If any of these pins are intentional, feel free to close this out.
Found with an automated scan of exact pins against the public OSV database. Each suggested version was rescanned before being proposed.
Hi, and thanks for publishing MeiGen-AI/OPSD-V. While looking at how recently released Python projects pin their dependencies, I found that one of the exact pins in this repository resolves to releases that OSV reports as affected by published advisories.
These are advisories in upstream packages, not in your code, and I have not checked whether the affected code paths are reachable from this project. Please treat this as information rather than a confirmed exploit path.
What was found
requirements.txtdiffusers==0.31.00.39.0Details
diffusers==0.31.0inrequirements.txttrust_remote_codebypass viacustom_pipelineand local custom components (fixed in 0.38.0)diffusers==0.39.0is the current release on PyPI, and querying OSV for that exact version returns no advisories.Suggested change
I have not verified that these upgrades are compatible with this project, and in a machine-learning stack the pinned versions may be deliberate for CUDA, driver, or checkpoint compatibility. If any of these pins are intentional, feel free to close this out.
Found with an automated scan of exact pins against the public OSV database. Each suggested version was rescanned before being proposed.