Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file. The vulnerability arises from insecure URL validation using the `startswith()` method, which can be bypassed through URL username injection. This allows attackers to craft URLs that appear to be from YouTube but resolve to malicious domains, potentially leading to phishing attacks, malware distribution, or data exfiltration. The issue is fixed in version 4.52.1.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/huggingface/transformers/commit/4dda5f71b35fb70cf602187eef84bb17a50b9082 | Patch |
| https://huntr.com/bounties/ccba0730-9248-4853-b7ff-5c20e6364f09 | Exploit Third Party Advisory |
Configurations
History
07 Aug 2025, 00:54
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Huggingface
Huggingface transformers |
|
| References | () https://huntr.com/bounties/ccba0730-9248-4853-b7ff-5c20e6364f09 - Exploit, Third Party Advisory | |
| References | () https://github.com/huggingface/transformers/commit/4dda5f71b35fb70cf602187eef84bb17a50b9082 - Patch | |
| CWE | NVD-CWE-noinfo | |
| CPE | cpe:2.3:a:huggingface:transformers:*:*:*:*:*:*:*:* |
07 Jul 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-07-07 10:15
Updated : 2025-08-07 00:54
NVD link : CVE-2025-3777
Mitre link : CVE-2025-3777
JSON object : View
Products Affected
huggingface
- transformers
CWE