SB2026021779 - Input validation error in Hugging Face Transformers

Description

This security bulletin contains information about 1 vulnerability.

1) Input validation error (CVE-ID: CVE-2025-3777)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to from insecure URL validation using the `startswith()` method, which can be bypassed through URL username injection. A remote user can trick the victim into opening a specially crafted URLs that appear to be from YouTube but resolve to malicious domains, potentially leading to phishing attacks, malware distribution, or data exfiltration.

Remediation

Install update from vendor's website.

References

• https://github.com/huggingface/transformers/commit/4dda5f71b35fb70cf602187eef84bb17a50b9082
• https://huntr.com/bounties/ccba0730-9248-4853-b7ff-5c20e6364f09