MEDIUM4.7PyPI
GHSA-282v-666c-3fvg· CVE-2023-2800, PYSEC-2023-299transformers has Insecure Temporary File
Modified: 11/22/2024
package
PyPI/transformers
pkg:pypi/transformers
HIGH7.8PyPI
GHSA-29pf-2h5f-8g72· CVE-2026-4372, PYSEC-2026-2289HuggingFace transformers vulnerable to remote code execution
Modified: 9/10/2026
MEDIUM5.3PyPI
GHSA-37mw-44qp-f5jm· CVE-2025-3933, PYSEC-2026-1977Transformers is vulnerable to ReDoS attack through its DonutProcessor class
Modified: 9/10/2026
LOW3.4PyPI
GHSA-37q5-v5qm-c9v8· CVE-2024-3568, PYSEC-2026-1978Transformers Deserialization of Untrusted Data vulnerability
Modified: 7/7/2026
CRITICAL9.0PyPI
GHSA-3863-2447-669p· CVE-2023-6730, PYSEC-2023-300transformers has a Deserialization of Untrusted Data vulnerability
Modified: 11/22/2024
MEDIUM5.3PyPI
GHSA-489j-g2vx-39wf· CVE-2025-3262, PYSEC-2026-1979Transformers vulnerable to ReDoS attack through its SETTING_RE variable
Modified: 7/7/2026
MEDIUM5.3PyPI
GHSA-4w7r-h757-3r74· CVE-2025-6921, PYSEC-2026-1980Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer
Modified: 9/10/2026
MEDIUM5.3PyPI
GHSA-59p9-h35m-wg4g· CVE-2025-6638, PYSEC-2026-1981Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer
Modified: 9/10/2026
MEDIUM6.5PyPI
GHSA-69w3-r845-3855· CVE-2026-1839, PYSEC-2026-2288HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class
Modified: 9/10/2026
MEDIUM5.3PyPI
GHSA-6rvg-6v2m-4j46· CVE-2024-12720, PYSEC-2026-1982Transformers Regular Expression Denial of Service (ReDoS) vulnerability
Modified: 8/13/2026
MEDIUM5.3PyPI
GHSA-9356-575x-2w9m· CVE-2025-5197, PYSEC-2026-1983Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability
Modified: 9/10/2026
HIGH8.0PyPI
GHSA-fgcw-684q-jj6r· CVE-2026-5241, PYSEC-2026-2290huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path
Modified: 9/10/2026
MEDIUM4.3PyPI
GHSA-fpwr-67px-3qhx· CVE-2025-1194, PYSEC-2026-1984Transformers Regular Expression Denial of Service (ReDoS) vulnerability
Modified: 8/13/2026
HIGH8.8PyPI
GHSA-hxxf-235m-72v3· CVE-2024-11394, PYSEC-2024-229Deserialization of Untrusted Data in Hugging Face Transformers
Modified: 9/10/2026
MEDIUM5.3PyPI
GHSA-jjph-296x-mrcr· CVE-2025-3264, PYSEC-2026-1985Transformers vulnerable to ReDoS attack through its get_imports() function
Modified: 7/7/2026
LOW3.5PyPI
GHSA-phhr-52qp-3mj4· CVE-2025-3777, PYSEC-2026-1986Transformers's Improper Input Validation vulnerability can be exploited through username injection
Modified: 9/10/2026
MEDIUM5.3PyPI
GHSA-q2wp-rjmx-x6x9· CVE-2025-3263, PYSEC-2026-1987Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking
Modified: 7/7/2026
MEDIUM5.3PyPI
GHSA-qq3j-4f4f-9583· CVE-2025-2099, PYSEC-2025-40Hugging Face Transformers Regular Expression Denial of Service
Modified: 9/25/2025
HIGH7.5PyPI
GHSA-qxrp-vhvm-j765· CVE-2024-11392, PYSEC-2024-227Deserialization of Untrusted Data in Hugging Face Transformers
Modified: 9/10/2026
MEDIUM5.3PyPI
GHSA-rcv9-qm8p-9p6j· CVE-2025-6051, PYSEC-2026-1988Hugging Face Transformers library has Regular Expression Denial of Service
Modified: 9/10/2026
HIGH7.8PyPI
GHSA-v68g-wm8c-6x7j· CVE-2023-7018, PYSEC-2023-301transformers has a Deserialization of Untrusted Data vulnerability
Modified: 11/22/2024
HIGH8.8PyPI
GHSA-wrfc-pvp9-mr9g· CVE-2024-11393, PYSEC-2024-228Deserialization of Untrusted Data in Hugging Face Transformers
Modified: 9/10/2026
HIGH7.1PyPI
GHSA-xrqw-3rrv-vx5w· CVE-2026-9856, PYSEC-2026-3929Transformers save_pretrained path traversal allows arbitrary file writes through chat template names
Modified: 9/10/2026
MEDIUM4.7PyPI
PYSEC-2023-299· CVE-2023-2800, GHSA-282v-666c-3fvgModified: 6/10/2026
HIGH8.8PyPI
PYSEC-2023-300· CVE-2023-6730, GHSA-3863-2447-669pModified: 6/10/2026
HIGH7.8PyPI
PYSEC-2023-301· CVE-2023-7018, GHSA-v68g-wm8c-6x7jModified: 6/10/2026
HIGH8.8PyPI
PYSEC-2024-227· CVE-2024-11392, GHSA-qxrp-vhvm-j765Modified: 6/10/2026
HIGH8.8PyPI
PYSEC-2024-228· CVE-2024-11393, GHSA-wrfc-pvp9-mr9gModified: 6/10/2026
HIGH8.8PyPI
PYSEC-2024-229· CVE-2024-11394, GHSA-hxxf-235m-72v3Modified: 6/10/2026
HIGH7.8PyPI
PYSEC-2025-211· CVE-2025-14920Modified: 5/21/2026
HIGH7.8PyPI
PYSEC-2025-212· CVE-2025-14921Modified: 5/21/2026
HIGH7.8PyPI
PYSEC-2025-213· CVE-2025-14924Modified: 5/21/2026
HIGH7.8PyPI
PYSEC-2025-214· CVE-2025-14926Modified: 5/21/2026
HIGH7.8PyPI
PYSEC-2025-215· CVE-2025-14927Modified: 5/21/2026
HIGH7.8PyPI
PYSEC-2025-216· CVE-2025-14928Modified: 5/21/2026
HIGH7.8PyPI
PYSEC-2025-217· CVE-2025-14929Modified: 5/21/2026
HIGH7.8PyPI
PYSEC-2025-218· CVE-2025-14930Modified: 5/21/2026
HIGH7.5PyPI
PYSEC-2025-40· CVE-2025-2099, GHSA-qq3j-4f4f-9583Modified: 6/10/2026
MEDIUM5.3PyPI
PYSEC-2026-1977· CVE-2025-3933, GHSA-37mw-44qp-f5jmTransformers is vulnerable to ReDoS attack through its DonutProcessor class
Modified: 7/7/2026
LOW3.4PyPI
PYSEC-2026-1978· CVE-2024-3568, GHSA-37q5-v5qm-c9v8Transformers Deserialization of Untrusted Data vulnerability
Modified: 7/7/2026
MEDIUM5.3PyPI
PYSEC-2026-1979· CVE-2025-3262, GHSA-489j-g2vx-39wfTransformers vulnerable to ReDoS attack through its SETTING_RE variable
Modified: 7/7/2026
MEDIUM5.3PyPI
PYSEC-2026-1980· CVE-2025-6921, GHSA-4w7r-h757-3r74Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer
Modified: 7/7/2026
MEDIUM5.3PyPI
PYSEC-2026-1981· CVE-2025-6638, GHSA-59p9-h35m-wg4gHugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer
Modified: 7/7/2026
MEDIUM5.3PyPI
PYSEC-2026-1982· CVE-2024-12720, GHSA-6rvg-6v2m-4j46Transformers Regular Expression Denial of Service (ReDoS) vulnerability
Modified: 7/7/2026
MEDIUM5.3PyPI
PYSEC-2026-1983· CVE-2025-5197, GHSA-9356-575x-2w9mHugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability
Modified: 7/7/2026
MEDIUM4.3PyPI
PYSEC-2026-1984· CVE-2025-1194, GHSA-fpwr-67px-3qhxTransformers Regular Expression Denial of Service (ReDoS) vulnerability
Modified: 7/7/2026
MEDIUM5.3PyPI
PYSEC-2026-1985· CVE-2025-3264, GHSA-jjph-296x-mrcrTransformers vulnerable to ReDoS attack through its get_imports() function
Modified: 7/7/2026
LOW3.5PyPI
PYSEC-2026-1986· CVE-2025-3777, GHSA-phhr-52qp-3mj4Transformers's Improper Input Validation vulnerability can be exploited through username injection
Modified: 7/7/2026
MEDIUM5.3PyPI
PYSEC-2026-1987· CVE-2025-3263, GHSA-q2wp-rjmx-x6x9Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking
Modified: 7/7/2026
MEDIUM5.3PyPI
PYSEC-2026-1988· CVE-2025-6051, GHSA-rcv9-qm8p-9p6jHugging Face Transformers library has Regular Expression Denial of Service
Modified: 7/7/2026
HIGH7.8PyPI
PYSEC-2026-2288· CVE-2026-1839, GHSA-69w3-r845-3855Modified: 7/13/2026
HIGH7.8PyPI
PYSEC-2026-2289· CVE-2026-4372, GHSA-29pf-2h5f-8g72Modified: 7/13/2026
CRITICAL9.6PyPI
PYSEC-2026-2290· CVE-2026-5241, GHSA-fgcw-684q-jj6rModified: 7/23/2026
HIGH7.1PyPI
PYSEC-2026-3929· CVE-2026-9856, GHSA-xrqw-3rrv-vx5wTransformers save_pretrained path traversal allows arbitrary file writes through chat template names
Modified: 9/10/2026