Input validation error in transformers - CVE-2025-3777
Published: February 17, 2026
Vulnerability identifier: #VU123001
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-3777
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to from insecure URL validation using the `startswith()` method, which can be bypassed through URL username injection. A remote user can trick the victim into opening a specially crafted URLs that appear to be from YouTube but resolve to malicious domains, potentially leading to phishing attacks, malware distribution, or data exfiltration.
Affected software
transformers
How to mitigate CVE-2025-3777
Install updates from vendor's website.
transformers - update to 4.52.1