Last seen July 7, 2025

dynamic_module_utils.py catastrophic backtracking Vulnerability

Evidence indicates that dynamic_module_utils.py is affected by a security issue. Reported affected versions include 4.49.0.

Technical Severity
Low severity
Lifecycle Status

RESOLVED

Sources

What Happened

Evidence indicates that dynamic_module_utils.py is affected by a security issue. Reported affected versions include 4.49.0.

Why This Matters

Publisher reporting describes a security event affecting ReDoS. BugSkan could not yet bind a CVE or affected version, so treat the source details as the current record.

Recommended Action

4.51.0 Identify deployments of dynamic_module_utils.py matching the evidenced affected versions: 4.49.0.

Exposure

My Interests Exposure

Exposure unknown

Recommended Response
Last Seen

Jul 07, 2025 18:00

Exposure reason: This incident does not currently match a technology in My Interests.

Exploitation status: UNKNOWN

Affected versions: 4.49.0

Primary entities:

Hugging FaceTransformers librarydynamic_module_utils.pyget_imports() functiontransformersSupply Chain

Timeline

  • Incident first seen
    Jul 07, 2025 18:00

    BugSkan first recorded this incident.

  • Transformers vulnerable to ReDoS attack through its get_imports() function
    Jul 07, 2025 18:00

    GitHub Advisory Database · Vulnerability

  • Transformers's Improper Input Validation vulnerability can be exploited through username injection
    Jul 07, 2025 18:00

    GitHub Advisory Database · Vulnerability

Sources

Transformers vulnerable to ReDoS attack through its get_imports() function

GitHub Advisory Database · Jul 07, 2025 18:00

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_imports()` function within `dynamic_module_utils.py`. This vulnerability affects versions 4.49.0 and is fixed in version 4.51.0. The issue arises from a regular expression pattern `\s*try\s*:.*?except.*?:` used to filter out try/except blocks from Python code, which can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. This vulnerability can lead to remote code loading disruption, resource exhaustion in model serving, supply chain attack vectors, and development pipeline disruption.

Open publisher source
Transformers's Improper Input Validation vulnerability can be exploited through username injection

GitHub Advisory Database · Jul 07, 2025 18:00

Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file. The vulnerability arises from insecure URL validation using the `startswith()` method, which can be bypassed through URL username injection. This allows attackers to craft URLs that appear to be from YouTube but resolve to malicious domains, potentially leading to phishing attacks, malware distribution, or data exfiltration. The issue is fixed in version 4.52.1.

Open publisher source

Other BugSkan incidents that share identifiers, products, or vendors with this report.

My Interests Match

Want personalized relevance?

Create an account to see which incidents overlap with your interests.

← Back to incident intelligence