Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:pypi/transformers@4.48.1
purl pkg:pypi/transformers@4.48.1
Next non-vulnerable version 4.49.0
Latest non-vulnerable version 4.53.0
Risk
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-7chd-q1tt-7fck
Aliases:
CVE-2025-2099
PYSEC-2025-40
A vulnerability in the `preprocess_string()` function of the `transformers.testing_utils` module in huggingface/transformers version v4.48.3 allows for a Regular Expression Denial of Service (ReDoS) attack. The regular expression used to process code blocks in docstrings contains nested quantifiers, leading to exponential backtracking when processing input with a large number of newline characters. An attacker can exploit this by providing a specially crafted payload, causing high CPU usage and potential application downtime, effectively resulting in a Denial of Service (DoS) scenario.
4.49.0
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-02T04:23:04.478734+00:00 Pypa Importer Affected by VCID-7chd-q1tt-7fck https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2025-40.yaml 38.6.0