Skip to content
OpenAdvisories

Package · PyPI

transformers

32 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 3.5
    CVE-2025-3777

    Improper Input Validation in huggingface/transformers

    Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file. The vulnerability arises from insecure URL validation using the `startswith()` method, which can be bypassed through URL u…

    Hugging Face huggingface/transformers transformers PyPI
  • Low 3.4
    CVE-2024-3568 Public exploit

    Arbitrary Code Execution via Deserialization in huggingface/transformers

    The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the `load_repo_checkpoint()` function of the `TFPreTrainedModel()` class. Attackers can execute arbitrary code and commands by craf…

    Hugging Face huggingface/transformers transformers PyPI