376 matches found
(0Day) Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face smolagents. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of pickle data. The issue results from the lack of proper validation...
PT-2025-52388
Name of the Vulnerable Software and Affected Versions Hugging Face smolagents affected versions not specified Description A flaw exists in Hugging Face smolagents that allows remote attackers to execute arbitrary code on affected systems. Authentication is not required for exploitation. The issue...
Cleartext Storage of Sensitive Information
Overview Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information due to the Hugging Face HFTOKEN. Because the token is exposed directly in environment variables, any user or process with access to container metadata, logs, or runtime inspection tools can...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an injection attack in huggingface/transformers [CVE-2025-3777]
Summary IBM Watson Speech Services Cartridge is vulnerable to an injection attack in huggingface/transformers, due to an improper input validation vulnerability in the imageutils.py file CVE-2025-3777, Huggingface/transformers is used in our speech service runtimes. This vulnerabilitiy has been...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Denial of Service in huggingface/transformers [CVE-2025-5197]
Summary IBM Watson Speech Services Cartridge is vulnerable to a Denial of Service in huggingface/transformers, due to an exploitable issue in the converttfweightnametoptweightname function CVE-2025-5197. Huggingface/transformers is used in our speech service runtimes. This vulnerabilitiy has been...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Denial of Service in huggingface/transformers [CVE-2025-3262, CVE-2025-3264, CVE-2025-3933, CVE-2025-3263]
Summary IBM Watson Speech Services Cartridge is vulnerable to a Denial of Service in huggingface/transformers, due to various issues identified within the package CVE-2025-3262, CVE-2025-3264, CVE-2025-3933, CVE-2025-3263. Huggingface/transformers is used in our speech service runtimes. This...
CVE-2025-11844
Hugging Face Smolagents 1.20.0 has an XPath injection in search_item_ctrl_f (vision_web_browser.py) where user input is concatenated into XPath queries without sanitization, allowing attackers to modify query logic, bypass filters, and access unintended DOM elements, potentially disrupting AI web...
CVE-2025-11844 XPath Injection in Hugging Face Smolagents search_item_ctrl_f Function
Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the searchitemctrlf function located in src/smolagents/visionwebbrowser.py. The function constructs an XPath query by directly concatenating user-supplied input into the XPath expression without proper sanitizatio...
Hugging Face Transformers 安全漏洞
Hugging Face Transformers is Hugging Face's open source advanced natural language processing for Jax, PyTorch and TensorFlow. A security vulnerability exists in Hugging Face Transformers version 1.20.0, which stems from the searchitemctrlf function splicing user input directly into XPath...
The vulnerability of the SubWordJapaneseTokenizer function in the Hugging Face Transformers library, which allows a hacker to trigger a service failure.
The vulnerability of the SubWordJapaneseTokenizer function in the Hugging Face Transformers library is related to the use of a regular expression with inefficient computational complexity. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...
The vulnerability of the normalize_numbers() function in the Hugging Face Transformers library, which allows a compromitter to trigger a ReDoS attack.
The vulnerability of the normalizenumbers function in the Hugging Face Transformers library is related to the use of a regular expression with inefficient computational complexity. Exploiting this vulnerability could allow a remote attacker to trigger a service denial-of-service attack ReDos...
EUVD-2025-29032
Malicious code in bioql PyPI...
EUVD-2025-15691
Malicious code in bioql PyPI...
EUVD-2025-20214
Malicious code in bioql PyPI...
EUVD-2025-23827
Malicious code in bioql PyPI...
EUVD-2025-0192
Malicious code in bioql PyPI...
EUVD-2025-29125
Malicious code in bioql PyPI...
EUVD-2025-20215
Malicious code in bioql PyPI...