allennlp (>=0.9.1.dev20200415, <=1.0.0rc4.dev20200511), allennlp-models (>=1.0.0rc2, <=1.0.0rc3) +6 more potentially affected by CVE-2025-3264 via transformers (2.8.0)

transformers PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =0.9.1.dev20200415, =1.0.0rc2, =0.1.9, =0.0.2, =0.1.0, =0.3.2 Source cves: CVE-2025-3264 Source advisory: OSV:GHSA-JJPH-296X-MR...

nlp2go (>=0.2.5, <=0.4.9), nlprep (>=0.1.56, <=0.1.57) +2 more potentially affected by CVE-2025-3264 via transformers (3.3.0)

transformers PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - nlp2go =0.2.5, =0.1.56, =0.2.11, =0.4.11, =0.5.13 Source cves: CVE-2025-3264 Source advisory: OSV:GHSA-JJPH-296X-MRCR...

sadedegel (>=0.11.3, <=0.18.3), treform (>=1.1.1, <=1.1.3) potentially affected by CVE-2025-3777 via transformers (3.0.0)

transformers PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - sadedegel =0.11.3, =1.1.1, =1.1.3 Source cves: CVE-2025-3777 Source advisory: OSV:GHSA-PHHR-52QP-3MJ4...

Transformers vulnerable to ReDoS attack through its SETTING_RE variable

A Regular Expression Denial of Service ReDoS vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular expression complexity in the SETTINGRE variable within the transformers/commands/chat.py file. The...

Regular Expression Denial of Service (ReDoS)

Overview transformers is a State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the SETTINGRE regular expression in /commands/chat.py. An attacker can cause significant performance...

allennlp (>=1.0.0rc6.dev20200602, <=1.1.0rc1.dev20200706), allennlp-models (>=1.1.0rc1.dev20200630, <=1.1.0rc1.dev20200706) +6 more potentially affected by CVE-2025-3777 via transformers (2.10.0)

transformers PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =1.0.0rc6.dev20200602, =1.1.0rc1.dev20200630, =0.0.6, =2.7.3, =0.2.15, =0.2.0, =0.3.0 Source cves: CVE-2025-3777 Source...

CVE-2025-3777

Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the imageutils.py file. The vulnerability arises from insecure URL validation using the startswith method, which can be bypassed through URL username injection. This allows attackers to...

CVE-2025-3263

A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Hugging Face Transformers library, specifically in the getconfigurationfile function within the transformers.configurationutils module. The affected version is 4.49.0, and the issue is resolved in version 4.51.0. The...

CVE-2025-3264

A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Hugging Face Transformers library, specifically in the getimports function within dynamicmoduleutils.py. This vulnerability affects versions 4.49.0 and is fixed in version 4.51.0. The issue arises from a regular...

CVE-2025-3262

A Regular Expression Denial of Service ReDoS vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular expression complexity in the SETTINGRE variable within the transformers/commands/chat.py file. The...

Improper Validation of Syntactic Correctness of Input

Overview transformers is a State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input via improper handling of user-supplied URLs by using the startswith method in imageutils.py. An...

CVE-2025-3777 Improper Input Validation in huggingface/transformers

Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the imageutils.py file. The vulnerability arises from insecure URL validation using the startswith method, which can be bypassed through URL username injection. This allows attackers to...

CVE-2025-3777 Improper Input Validation in huggingface/transformers

Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the imageutils.py file. The vulnerability arises from insecure URL validation using the startswith method, which can be bypassed through URL username injection. This allows attackers to...

3m (0.1.0), aaa-ml-datasets-course (1.0.0) +1784 more potentially affected by CVE-2025-3777 via transformers (>=0.1.0, <=4.52.0)

transformers PYPI version =0.1.0, =0.0.4.80, =0.1.1, =0.1.0, =0.0.3, =0.0.1, =0.0.0.dev20230804, =0.1.0, =0.2.0, =0.1.0, =0.2.5, =0.0.1, =0.1.0, =0.1.1 and more Source cves: CVE-2025-3777 Source advisory: MEND:CVE-2025-3777...

3m (0.1.0), aaa-ml-datasets-course (1.0.0) +1780 more potentially affected by CVE-2025-3777 via transformers (>=0.1.0, <=4.51.3)

transformers PYPI version =0.1.0, =0.0.4.80, =0.1.1, =0.1.0, =0.0.3, =0.0.1, =0.0.0.dev20230804, =0.1.0, =0.2.0, =0.1.0, =0.2.5, =0.0.1, =0.1.0, =0.1.1 and more Source cves: CVE-2025-3777 Source advisory: SNYK:PYTHON-TRANSFORMERS-10658536...

CVE-2025-3777

Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the "imageutils.py" file. The vulnerability arises from insecure URL validation using the "startswith" method, which can be bypassed through URL username injection. This allows attackers ...

CVE-2025-3777

CVE-2025-3777 : In Hugging Face Transformers, versions up to 4.49.0 are affected by improper input validation in image_utils.py due to insecure URL validation with startswith(), bypassable via URL username injection. Attackers could craft URLs that appear to be from YouTube but resolve to malicio...

CVE-2025-3777 Improper Input Validation in huggingface/transformers

Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the imageutils.py file. The vulnerability arises from insecure URL validation using the startswith method, which can be bypassed through URL username injection. This allows attackers to...

CVE-2025-3264

A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Hugging Face Transformers library, specifically in the "getimports" function within "dynamicmoduleutils.py". This vulnerability affects versions 4.49.0 and is fixed in version 4.51.0. The issue arises from a regular...

CVE-2025-3264

CVE-2025-3264 (Hugging Face Transformers) is a ReDoS in get_imports() of dynamic_module_utils.py. The issue stems from a regex used to filter out Python try/except blocks: \stry\s :.?except. ?:, which can cause catastrophic backtracking and excessive CPU usage. Affected versions are 4.49.0; fixed...