VDB
EN
LOW 3.5

PYSEC-2026-1986

Transformers's Improper Input Validation vulnerability can be exploited through username injection

상세

Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file. The vulnerability arises from insecure URL validation using the `startswith()` method, which can be bypassed through URL username injection. This allows attackers to craft URLs that appear to be from YouTube but resolve to malicious domains, potentially leading to phishing attacks, malware distribution, or data exfiltration. The issue is fixed in version 4.52.1.

이 버전이 영향받나요?

사용 중인 패키지 버전을 입력하면 즉시 평가합니다.

영향 패키지

PyPI / transformers
최초 영향 버전: 0 수정 버전: 4.52.1
수정 pip install --upgrade 'transformers>=4.52.1'

참고