# CVE-2025-3777: Improper Input Validation in huggingface/transformers

> CVE-2025-3777: Improper Input Validation in huggingface/transformers. CVSS 3.5 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2025-3777
Last updated: 2026-06-17T09:20:39Z

- Published: 2025-07-07 09:55 UTC · Updated: 2026-06-17 09:20 UTC · Assigner: @huntr\_ai
- CVSS: 3.5 (CVSS 3.1) · Severity: Low · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
- EPSS: 0.41%, 35th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-20

## Description

Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the \`image\_utils.py\` file. The vulnerability arises from insecure URL validation using the \`startswith()\` method, which can be bypassed through URL username injection. This allows attackers to craft URLs that appear to be from YouTube but resolve to malicious domains, potentially leading to phishing attacks, malware distribution, or data exfiltration. The issue is fixed in version 4.52.1.

## Affected vendors and products

- huggingface: huggingface/transformers

## Tracked companies

- [Hugging Face](https://rewindex.com/company/hugging-face.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2025-3777)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2025-3777)
- [https://github.com/huggingface/transformers/commit/4dda5f71b35fb70cf602187eef84bb17a50b9082](https://github.com/huggingface/transformers/commit/4dda5f71b35fb70cf602187eef84bb17a50b9082)
- [https://huntr.com/bounties/ccba0730-9248-4853-b7ff-5c20e6364f09](https://huntr.com/bounties/ccba0730-9248-4853-b7ff-5c20e6364f09)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2025-3777 · Markdown: https://rewindex.com/cve/CVE-2025-3777.md · JSON: https://rewindex.com/api/v1/cves/CVE-2025-3777 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:13:35.500Z