VulnerabilityAnalyzed

CVE-2025-3777

Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file.

LOW 3.5EPSS 0.36%

Does this matter?

Lower severity and a low EPSS score (0.36%). Track it; it rarely justifies an emergency change on its own.

Description

Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file. The vulnerability arises from insecure URL validation using the `startswith()` method, which can be bypassed through URL username injection. This allows attackers to craft URLs that appear to be from YouTube but resolve to malicious domains, potentially leading to phishing attacks, malware distribution, or data exfiltration. The issue is fixed in version 4.52.1.

CVSS 3.0: 3.5 LOWCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
EPSS: 0.36% probability · 29th percentile
CISA KEV: Not listed
Weakness: CWE-20
Affected: huggingface/transformers
Source: security@huntr.dev

References

https://github.com/huggingface/transformers/commit/4dda5f71b35fb70cf602187eef84bb17a50b9082Patch
https://huntr.com/bounties/ccba0730-9248-4853-b7ff-5c20e6364f09Exploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.