Executive brief
Transformers's Improper Input Validation vulnerability can be exploited through username injection
Affected products
- PyPI transformers
Junglewise Threat Intelligence
CVE-2025-3777: PYSEC-2026-1986 - Transformers's Improper Input Validation vulnerability can be exploited through username injection
CVE-2025-3777 · Severity: low · CVSS 3 · Published 2026-07-07
Technologies: transformers (PyPI). Vendors: PyPI.
Related threats
- A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. Th
- PYSEC-2026-1980 - Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer
- PYSEC-2026-1988 - Hugging Face Transformers library has Regular Expression Denial of Service
- PYSEC-2026-1981 - Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer
- PYSEC-2026-1983 - Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability