Strix
26.1K

CVE-2025-3777

UnknownEPSS 0.33%

Last modified

CVE-2025-3777 is a vulnerability of currently unknown severity. Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file. The vulnerability arises from insecure URL validation using the `startswith()` method, which can be bypassed through URL username injection. EPSS estimates a 0.33% chance of exploitation in the next 30 days.

Description

Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file. The vulnerability arises from insecure URL validation using the `startswith()` method, which can be bypassed through URL username injection. This allows attackers to craft URLs that appear to be from YouTube but resolve to malicious domains, potentially leading to phishing attacks, malware distribution, or data exfiltration. The issue is fixed in version 4.52.1.

Metrics

EPSS Probability
0.33%

24.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
HuggingfaceTransformers< 4.52.1

References

Timeline

Published
Last Modified
Status
Analyzed

Frequently Asked Questions

What is CVE-2025-3777?
Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file. The vulnerability arises from insecure URL validation using the `startswith()` method, which can be bypassed through URL username injection. This allows attackers to craft URLs that appear to be from YouTube but resolve to malicious domains, potentially leading to phishing attacks, malware distribution, or data exfiltration. The issue is fixed in version 4.52.1.
How severe is CVE-2025-3777?
Severity scoring for CVE-2025-3777 is pending analysis. The EPSS model estimates a 0.33% probability of exploitation in the next 30 days.
How do I fix CVE-2025-3777?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2025-3777?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST