Improper Input Validation in Hugging Face Transformers Affects Multiple Versions

CVE-2025-3777

What is CVE-2025-3777?

The Hugging Face Transformers library, specifically versions up to 4.49.0, contains an improper input validation vulnerability originating from the image_utils.py file. The flaw is caused by insecure URL validation leveraging the startswith() method, which can be circumvented via URL username injection. This loophole permits attackers to generate deceptive URLs mimicking those from YouTube that ultimately redirect users to malicious sites. Such vulnerabilities can lead to severe security risks, including phishing attacks, malware distribution, and potential data exfiltration. The issue has been resolved in version 4.52.1.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

News Articles

Yanac.hu

CVE-2025-3777

CVE-2025-3777 | huggingface transformers up to 4.52.0 URL Validation image_utils.py startswith information disclosure

A vulnerability was found in huggingface transformers up to 4.52.0. It has been declared as problematic. Affected by this vulnerability is the function startswith of the file image_utils.py of the…

References