allennlp (>=1.0.0rc4.dev20200513, <=1.0.0rc6.dev20200601), allennlp-models (>=1.0.0rc4, <=1.0.0rc5) potentially affected by CVE-2025-3264 via transformers (2.9.1)

transformers PYPI version 2.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =1.0.0rc4.dev20200513, =1.0.0rc4, =1.0.0rc5 Source cves: CVE-2025-3264 Source advisory: OSV:GHSA-JJPH-296X-MRCR...

allennlp (>=0.9.1.dev20200404, <=0.9.1.dev20200413), pygaggle (0.0.1) potentially affected by CVE-2025-3777 via transformers (2.7.0)

transformers PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =0.9.1.dev20200404, =0.9.1.dev20200413 - pygaggle 0.0.1 Source cves: CVE-2025-3777 Source advisory: OSV:GHSA-PHHR-52QP-3MJ4...

pvqa (0.0.2.1) potentially affected by CVE-2025-3263 via transformers (2.1.1)

transformers PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - pvqa 0.0.2.1 Source cves: CVE-2025-3263 Source advisory: OSV:GHSA-Q2WP-RJMX-X6X9...

adaptnlp (>=0.2.0, <=0.2.2), allennlp (1.2.2) +29 more potentially affected by CVE-2025-3263 via transformers (3.5.1)

transformers PYPI version 3.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - adaptnlp =0.2.0, =0.0.7, =0.2.0, =0.0.1, =0.0.1, =0.1.8, =0.1.0, =0.0.8, =0.0.9 and more Source cves: CVE-2025-3263 Source advisory:...

GHSA-PHHR-52QP-3MJ4 Transformers's Improper Input Validation vulnerability can be exploited through username injection

Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the imageutils.py file. The vulnerability arises from insecure URL validation using the startswith method, which can be bypassed through URL username injection. This allows attackers to...

GHSA-Q2WP-RJMX-X6X9 Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking

A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Hugging Face Transformers library, specifically in the getconfigurationfile function within the transformers.configurationutils module. The affected version is 4.49.0, and the issue is resolved in version 4.51.0. The...

allennlp (1.2.0rc1.dev20200923), awca (>=0.0.2, <=0.0.3.2) +9 more potentially affected by CVE-2025-3777 via transformers (3.1.0)

transformers PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp 1.2.0rc1.dev20200923 - awca =0.0.2, =0.2.4, =0.4.8, =1.1.1, =1.1.0.dev202009251125, =2.1.0, =1.0.1, =1.1.0 Source cves:...

allennlp (1.2.0rc1.dev20200923), awca (>=0.0.2, <=0.0.3.2) +9 more potentially affected by CVE-2025-3264 via transformers (3.1.0)

transformers PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp 1.2.0rc1.dev20200923 - awca =0.0.2, =0.2.4, =0.4.8, =1.1.1, =1.1.0.dev202009251125, =2.1.0, =1.0.1, =1.1.0 Source cves:...

allennlp (>=1.1.0rc1.dev20200710, <=1.1.0), allennlp-models (>=1.1.0rc1, <=1.1.0) +26 more potentially affected by CVE-2025-3263 via transformers (3.0.2)

transformers PYPI version 3.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =1.1.0rc1.dev20200710, =1.1.0rc1, =0.7.1, =0.0.1, =0.1.0, =0.4.6, =1.9.0, =0.0.1.dev0, =0.3.1, =0.1.0, =0.1.3 and more Source...

3m (0.1.0), aaa-ml-datasets-course (1.0.0) +1694 more potentially affected by CVE-2025-3777 via transformers (>=4.0.0rc1, <=4.52.0)

transformers PYPI version =4.0.0rc1, =0.0.4.80, =0.1.1, =0.1.0, =0.0.3, =0.0.0.dev20230804, =0.1.0, =0.3.0, =0.1.0, =0.2.5, =0.0.1, =0.1.0, =0.1.1 - advtok 0.0.2 and more Source cves: CVE-2025-3777 Source advisory: GHSA-PHHR-52QP-3MJ4...

agent-memory-jojo (0.1.3), airunner (>=3.2.0, <=4.1.1) +130 more potentially affected by CVE-2025-3262 via transformers (>=4.49.0, <=4.50.3)

transformers PYPI version =4.49.0, =3.2.0, =2026.3.1, =0.1.2, =0.1.0, =1.3.2b20250620, =1.2.1b20250404, =1.2.1b20250404, =0.1.2, =0.4.3, =1.1.6, =1.2.11 and more Source cves: CVE-2025-3262 Source advisory: SNYK:PYTHON-TRANSFORMERS-10658533...

3m (0.1.0), aaa-ml-datasets-course (1.0.0) +1694 more potentially affected by CVE-2025-3777 via transformers (>=4.0.0rc1, <=4.52.0)

transformers PYPI version =4.0.0rc1, =0.0.4.80, =0.1.1, =0.1.0, =0.0.3, =0.0.0.dev20230804, =0.1.0, =0.3.0, =0.1.0, =0.2.5, =0.0.1, =0.1.0, =0.1.1 - advtok 0.0.2 and more Source cves: CVE-2025-3777 Source advisory: OSV:GHSA-PHHR-52QP-3MJ4...

3m (0.1.0), aaa-ml-datasets-course (1.0.0) +1616 more potentially affected by CVE-2025-3264 via transformers (>=4.0.0rc1, <=4.50.3)

transformers PYPI version =4.0.0rc1, =0.1.1, =0.1.0, =0.0.3, =0.0.0.dev20230804, =0.1.0, =0.3.0, =0.1.0, =0.2.5, =0.0.1, =0.1.0, =0.1.1 - advtok 0.0.2 and more Source cves: CVE-2025-3264 Source advisory: OSV:GHSA-JJPH-296X-MRCR...

adaptnlp (>=0.2.0, <=0.2.2), allennlp (1.2.2) +29 more potentially affected by CVE-2025-3777 via transformers (3.5.1)

transformers PYPI version 3.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - adaptnlp =0.2.0, =0.0.7, =0.2.0, =0.0.1, =0.0.1, =0.1.8, =0.1.0, =0.0.8, =0.0.9 and more Source cves: CVE-2025-3777 Source advisory:...

adamix-gpt2 (>=0.0.1, <=0.0.2), allennlp (>=1.2.0rc1.dev20200930, <=1.2.0rc1.dev20201021) +6 more potentially affected by CVE-2025-3263 via transformers (3.3.1)

transformers PYPI version 3.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - adamix-gpt2 =0.0.1, =1.2.0rc1.dev20200930, =1.2.0rc1.dev20201007, =0.0.1, =0.5.0, =0.1.11, =0.1.12 - mc-transformers 0.1.11 Source cves:...

nlp2go (>=0.2.5, <=0.4.9), nlprep (>=0.1.56, <=0.1.57) +2 more potentially affected by CVE-2025-3777 via transformers (3.3.0)

transformers PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - nlp2go =0.2.5, =0.1.56, =0.2.11, =0.4.11, =0.5.13 Source cves: CVE-2025-3777 Source advisory: OSV:GHSA-PHHR-52QP-3MJ4...

allennlp (>=1.2.0rc1.dev20200924, <=1.2.0rc1.dev20200929) potentially affected by CVE-2025-3263 via transformers (3.2.0)

transformers PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =1.2.0rc1.dev20200924, =1.2.0rc1.dev20200929 Source cves: CVE-2025-3263 Source advisory: OSV:GHSA-Q2WP-RJMX-X6X9...

allennlp (>=1.2.0rc1.dev20200924, <=1.2.0rc1.dev20200929) potentially affected by CVE-2025-3777 via transformers (3.2.0)

transformers PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =1.2.0rc1.dev20200924, =1.2.0rc1.dev20200929 Source cves: CVE-2025-3777 Source advisory: OSV:GHSA-PHHR-52QP-3MJ4...

allennlp (1.2.0rc1.dev20200923), awca (>=0.0.2, <=0.0.3.2) +9 more potentially affected by CVE-2025-3263 via transformers (3.1.0)

transformers PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp 1.2.0rc1.dev20200923 - awca =0.0.2, =0.2.4, =0.4.8, =1.1.1, =1.1.0.dev202009251125, =2.1.0, =1.0.1, =1.1.0 Source cves:...

allennlp (>=1.1.0rc1.dev20200710, <=1.1.0), allennlp-models (>=1.1.0rc1, <=1.1.0) +26 more potentially affected by CVE-2025-3777 via transformers (3.0.2)

transformers PYPI version 3.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =1.1.0rc1.dev20200710, =1.1.0rc1, =0.7.1, =0.0.1, =0.1.0, =0.4.6, =1.9.0, =0.0.1.dev0, =0.3.1, =0.1.0, =0.1.3 and more Source...