CVE-2025-3777: Improper Input Validation in huggingface/transformers
Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the imageutils.py file. The vulnerability arises from insecure URL validation using the startswith() method, which can be bypassed through URL username injection. This allows attackers to craft URLs that appear to be from YouTube but resolve to malicious domains, potentially leading to phishing attacks, malware distribution, or data exfiltration. The issue is fixed in version 4.52.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/transformersto a version that resolves this vulnerability.Fixed in 4.52.1 - Upgrade
Upgrade
huggingface/transformersto a version that resolves this vulnerability.Fixed in 4.52.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3777?
CVE-2025-3777 is classified as a high severity vulnerability due to improper input validation in Hugging Face Transformers.
How do I fix CVE-2025-3777?
To mitigate CVE-2025-3777, update Hugging Face Transformers to version 4.50.0 or later.
What does CVE-2025-3777 affect?
CVE-2025-3777 affects Hugging Face Transformers versions up to and including 4.49.0.
What is the nature of the vulnerability in CVE-2025-3777?
CVE-2025-3777 involves insecure URL validation due to the use of the 'startswith()' method.
Can CVE-2025-3777 be exploited?
Yes, CVE-2025-3777 can be exploited through URL username injection which could allow an attacker to bypass validation.