Improper Input Validation in Hugging Face Transformers Affects Multiple Versions

CVE-2025-3777

What is CVE-2025-3777?

The Hugging Face Transformers library, specifically versions up to 4.49.0, contains an improper input validation vulnerability originating from the image_utils.py file. The flaw is caused by insecure URL validation leveraging the startswith() method, which can be circumvented via URL username injection. This loophole permits attackers to generate deceptive URLs mimicking those from YouTube that ultimately redirect users to malicious sites. Such vulnerabilities can lead to severe security risks, including phishing attacks, malware distribution, and potential data exfiltration. The issue has been resolved in version 4.52.1.

References