CVE - CVE-2025-3777

CVE-ID
CVE-2025-3777	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file. The vulnerability arises from insecure URL validation using the `startswith()` method, which can be bypassed through URL username injection. This allows attackers to craft URLs that appear to be from YouTube but resolve to malicious domains, potentially leading to phishing attacks, malware distribution, or data exfiltration. The issue is fixed in version 4.52.1.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/huggingface/transformers/commit/4dda5f71b35fb70cf602187eef84bb17a50b9082 URL:https://github.com/huggingface/transformers/commit/4dda5f71b35fb70cf602187eef84bb17a50b9082 MISC:https://huntr.com/bounties/ccba0730-9248-4853-b7ff-5c20e6364f09 URL:https://huntr.com/bounties/ccba0730-9248-4853-b7ff-5c20e6364f09
Assigning CNA
Protect AI
Date Record Created
20250417	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20250417)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)