0token (>=0.1.0, <=0.4.0), 3-04-2025-ttm (0.1.0) +12410 more potentially affected by CVE-2025-14921 via transformers (>=0.1.0, <=5.16.1)

transformers PYPI version =0.1.0, =0.1.0, =0.1.0, =0.1.3, =0.1.0, =0.1.0, =0.0.1, =0.1.0.dev1, =0.1.5, =0.1.0, =0.10.11, =0.5.5, =0.0.4.80, =5.0.6 and more Source cves: CVE-2025-14921 Source advisory: SNYK:PYTHON-TRANSFORMERS-14564365...

CVE-2025-14921

CVE-2025-14921 affects Hugging Face Transformers (Transformer-XL) with a flaw in parsing Transformer-XL model files that fails to validate untrusted input, enabling deserialization of untrusted data and remote code execution. The underlying cause is insufficient validation during model-file parsi...