CVE-2025-6638: Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer

Transformers 安全公告 · 来源更新 2025/09/15 21:59

今日摘要使用自己的 API，仅供个人查看

来源摘要

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's `remove_language_code()` method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. The issue arises from inefficient regex processing, which can be exploited by crafted input strings containing malformed language code patterns, leading to excessive CPU consumption and potential denial of service.

阅读原始来源

来源: Transformers 安全公告 · 社区 / 第三方
来源发布: 2025/09/12 20:30
来源更新: 2025/09/15 21:59
首次采集: 2026/09/19 13:00

本文为公开信息索引与摘要，详情及后续变化请以原始来源为准。

CVE-2026-9856: Transformers save_pretrained path traversal allows arbitrary file writes through chat template names

A vulnerability in huggingface/transformers versions < 5.10.0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the `save_pretrained()` methods of `PreTrainedTokenizerBase` and `ProcessorMixin`, where keys from the `c

来源更新 2026/09/02 02:58国际查看原文

漏洞与安全Transformers 安全公告社区 / 第三方

CVE-2026-5241: huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path

A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the `trust_remote_code` parameter, inte

来源更新 2026/07/21 20:33国际查看原文

漏洞与安全LangChain 安全公告社区 / 第三方

CVE-2026-55443: LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders

## Summary Several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the *resolved* path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting

来源更新 2026/07/09 01:37国际查看原文

漏洞与安全Transformers 安全公告社区 / 第三方

CVE-2026-4372: HuggingFace transformers vulnerable to remote code execution

A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious `config.json` file containing the `_attn_implementation_internal` fi

来源更新 2026/07/02 02:00国际查看原文

漏洞与安全LangChain 安全公告社区 / 第三方

CVE-2026-45134: LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning

## Description The LangSmith SDK's prompt pull methods (`pull_prompt` / `pull_prompt_commit` in Python, `pullPrompt` / `pullPromptCommit` in JS/TS) fetch and deserialize prompt manifests from the LangSmith Hub. These manifests may contain serialized LangChain

来源更新 2026/06/09 07:54国际查看原文