544 matches found
PT-2025-28152
Name of the Vulnerable Software and Affected Versions: Hugging Face Transformers versions 4.49.0 through 4.50.0 Description: A Regular Expression Denial of Service ReDoS vulnerability exists in the Hugging Face Transformers library, specifically within the get imports function of dynamic module...
PT-2025-28151
Name of the Vulnerable Software and Affected Versions: Hugging Face Transformers version 4.49.0 Description: A Regular Expression Denial of Service ReDoS issue was discovered in the Hugging Face Transformers library, specifically in the get configuration file function within the...
Regular expression Denial of Service - ReDoS
Description The regex defined in the variable SETTINGRE contains repetition groups and non-optimized quantifiers, which can lead to exponential backtracking when receiving "almost matching" payloads. This may degrade the application's performance or even cause a denial-of-service DoS when...
PT-2025-28150
Name of the Vulnerable Software and Affected Versions: huggingface/transformers version 4.49.0 Description: A Regular Expression Denial of Service ReDoS vulnerability was discovered in the huggingface/transformers repository. The vulnerability is due to inefficient regular expression complexity i...
Exploit for Deserialization of Untrusted Data in Huggingface Transformers
CVE-2024-11394 Hugging Face Transformers Trax Model Deseri...
Exploit for Deserialization of Untrusted Data in Huggingface Transformers
CVE-2024-11393 Hugging Face Transformers MaskFormer Model D...
Exploit for Deserialization of Untrusted Data in Huggingface Transformers
CVE-2024-11392 Hugging Face Transformers MobileViTV2 Des...
Regular expression Denial of Service - ReDoS
Description A Regular Expression Denial of Service ReDoS vulnerability identified in the Transformers library, specifically in the file tokenizationnougatfast.py. The vulnerability occurs in the postprocesssingle function, where a regular expression processes specially crafted input. The issue...
The vulnerability of the Intel Extension for Transformers tool set arises from incorrect name restrictions for paths to the restricted catalog. This allows attackers to escalate their privileges.
The vulnerability of the Intel Extension for Transformers tool set is related to an incorrect name restriction for the path to the restricted access catalog. Exploiting this vulnerability can allow attackers to enhance their privileges...
CVE-2024-11394
A flaw was found in the Trax model of the Hugging Face Transformers library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. This flaw allows an attacker to execute code in the context of the current user...
CVE-2024-11393
A flaw was found in the MaskFormer model of the Hugging Face Transformers library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. This flaw allows an attacker to execute code in the context of the current user...
CVE-2024-11392
A flaw was found in the MobileViTV2 model of the Hugging Face Transformers library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. This flaw allows an attacker to execute code in the context of the current user...
3m (=0.1.0), aaa-ml-datasets-course (=1.0.0) +1525 more potentially affected by CVE-2024-11394 via transformers (>=2.10.0 <=4.47.1)
transformers PYPI version =2.10.0, =0.1.1, =0.1.0, =0.0.3, =0.0.1, =0.0.0.dev20230804, =0.1.0, =0.3.0, =0.1.0, =0.2.5, =0.0.1, =0.1.0, =0.1.1 and more Source cves: CVE-2024-11394 Source advisory: OSV:GHSA-HXXF-235M-72V3...
3m (=0.1.0), aaa-ml-datasets-course (=1.0.0) +1525 more potentially affected by CVE-2024-11392 via transformers (>=2.10.0 <=4.47.1)
transformers PYPI version =2.10.0, =0.1.1, =0.1.0, =0.0.3, =0.0.1, =0.0.0.dev20230804, =0.1.0, =0.3.0, =0.1.0, =0.2.5, =0.0.1, =0.1.0, =0.1.1 and more Source cves: CVE-2024-11392 Source advisory: OSV:GHSA-QXRP-VHVM-J765...
Deserialization of Untrusted Data in Hugging Face Transformers
Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in...
Deserialization of Untrusted Data in Hugging Face Transformers
Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability...
Deserialization of Untrusted Data in Hugging Face Transformers
Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in th...
GHSA-HXXF-235M-72V3 Deserialization of Untrusted Data in Hugging Face Transformers
Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in th...
3m (=0.1.0), aaa-ml-datasets-course (=1.0.0) +1525 more potentially affected by CVE-2024-11393 via transformers (>=2.10.0 <=4.47.1)
transformers PYPI version =2.10.0, =0.1.1, =0.1.0, =0.0.3, =0.0.1, =0.0.0.dev20230804, =0.1.0, =0.3.0, =0.1.0, =0.2.5, =0.0.1, =0.1.0, =0.1.1 and more Source cves: CVE-2024-11393 Source advisory: OSV:GHSA-WRFC-PVP9-MR9G...
