nlp-architect (0.5.2), vtorch (0.1.69) potentially affected by CVE-2025-3933 via transformers (2.2.1)

transformers PYPI version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - nlp-architect 0.5.2 - vtorch 0.1.69 Source cves: CVE-2025-3933 Source advisory: OSV:GHSA-37MW-44QP-F5JM...

pvqa (0.0.2.1) potentially affected by CVE-2025-3933 via transformers (2.1.1)

transformers PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - pvqa 0.0.2.1 Source cves: CVE-2025-3933 Source advisory: OSV:GHSA-37MW-44QP-F5JM...

aspect-based-sentiment-analysis (2.0.2), docly (>=0.0.4, <=0.2.1) +2 more potentially affected by CVE-2025-3933 via transformers (2.5.0)

transformers PYPI version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - aspect-based-sentiment-analysis 2.0.2 - docly =0.0.4, =0.0.7b0, =0.1.9, =0.1.18 Source cves: CVE-2025-3933 Source advisory:...

allennlp (>=1.2.0rc1.dev20201022, <=1.2.1), allennlp-models (>=1.2.0rc1.dev20201022, <=1.2.1) +5 more potentially affected by CVE-2025-3933 via transformers (3.4.0)

transformers PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =1.2.0rc1.dev20201022, =1.2.0rc1.dev20201022, =0.0.4, =0.0.1, =2.2.5, =2.3.1 Source cves: CVE-2025-3933 Source advisory:...

CVE-2025-3933

A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's token2json method. This vulnerability affects versions 4.50.3 and earlier, and is fixed in version 4.52.1. The issue arises from the...

CVE-2025-3933 Regular Expression Denial of Service (ReDoS) in huggingface/transformers

A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's token2json method. This vulnerability affects versions 4.50.3 and earlier, and is fixed in version 4.52.1. The issue arises from the...

CVE-2025-3933 Regular Expression Denial of Service (ReDoS) in huggingface/transformers

A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's token2json method. This vulnerability affects versions 4.50.3 and earlier, and is fixed in version 4.52.1. The issue arises from the...

3m (0.1.0), aaa-ml-datasets-course (1.0.0) +1784 more potentially affected by CVE-2025-3933 via transformers (>=0.1.0, <=4.52.0)

transformers PYPI version =0.1.0, =0.0.4.80, =0.1.1, =0.1.0, =0.0.3, =0.0.1, =0.0.0.dev20230804, =0.1.0, =0.2.0, =0.1.0, =0.2.5, =0.0.1, =0.1.0, =0.1.1 and more Source cves: CVE-2025-3933 Source advisory: MEND:CVE-2025-3933...

CVE-2025-3933 Regular Expression Denial of Service (ReDoS) in huggingface/transformers

A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's token2json method. This vulnerability affects versions 4.50.3 and earlier, and is fixed in version 4.52.1. The issue arises from the...

CVE-2025-3933

A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's "token2json" method. This vulnerability affects versions 4.50.3 and earlier, and is fixed in version 4.52.1. The issue arises from the...

Hugging Face Transformers security vulnerabilities

Hugging Face Transformers is Hugging Face's open source advanced natural language processing for Jax, PyTorch and TensorFlow. A security vulnerability exists in Hugging Face Transformers version 4.50.3 and earlier, which stems from a regular expression denial of service in the token2json method o...

CVE-2025-3933: Inefficient Regular Expression Complexity

A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's token2json method. This vulnerability affects versions 4.50.3 and earlier, and is fixed in version 4.52.1. The issue arises from the...

Exploit for CVE-2024-3568

Exploitation of pickle deserialization vulnerabilities in Tran...

Invariant-Based Robust Weights Watermark for Large Language Models

Watermarking technology has gained significant attention due to the increasing importance of intellectual property IP rights, particularly with the growing deployment of large language models LLMs on billions resource-constrained edge devices. To counter the potential threats of IP theft by...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to denial of service and improper input validation [CVE-2025-3262] [CVE-2025-3263] [CVE-2025-3264] [CVE-2025-3777]

Summary Python module transformers is used by IBM App Connect Enterprise Certified Container by the mapping assistance capability. IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to denial of service and improper input validatio...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in transformers 4.36.2

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of transformers 4.36.2 Vulnerability Details CVEID:CVE-2024-3568 DESCRIPTION: The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the...

allennlp (>=1.2.0rc1.dev20200924, <=1.2.0rc1.dev20200929) potentially affected by CVE-2025-3264 via transformers (3.2.0)

transformers PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =1.2.0rc1.dev20200924, =1.2.0rc1.dev20200929 Source cves: CVE-2025-3264 Source advisory: OSV:GHSA-JJPH-296X-MRCR...

agent-memory-jojo (0.1.3), airunner (>=3.2.0, <=4.1.1) +130 more potentially affected by CVE-2025-3262 via transformers (>=4.49.0, <=4.50.3)

transformers PYPI version =4.49.0, =3.2.0, =2026.3.1, =0.1.2, =0.1.0, =1.3.2b20250620, =1.2.1b20250404, =1.2.1b20250404, =0.1.2, =0.4.3, =1.1.6, =1.2.11 and more Source cves: CVE-2025-3262 Source advisory: GHSA-489J-G2VX-39WF...

custom-glue (>=0.0.1, <=0.0.6), megatron-bridge (>=0.3.0, <=0.3.1) +2 more potentially affected by CVE-2025-3777 via transformers (2.3.0)

transformers PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - custom-glue =0.0.1, =0.3.0, =0.0.5, =0.0.9 - nlp-architect 0.5.3 Source cves: CVE-2025-3777 Source advisory: OSV:GHSA-PHHR-52QP-3MJ4...

allennlp (>=1.2.0rc1.dev20201022, <=1.2.1), allennlp-models (>=1.2.0rc1.dev20201022, <=1.2.1) +5 more potentially affected by CVE-2025-3264 via transformers (3.4.0)

transformers PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =1.2.0rc1.dev20201022, =1.2.0rc1.dev20201022, =0.0.4, =0.0.1, =2.2.5, =2.3.1 Source cves: CVE-2025-3264 Source advisory:...