CVE-2025-3777

CVE-2025-3777 is an improper input validation vulnerability in Hugging Face Transformers versions up to 4.49.0, specifically within the image_utils.py file. This flaw allows attackers to bypass URL validation using username injection, enabling them to craft seemingly legitimate YouTube URLs that redirect to malicious domains. The vulnerability has a low CVSS score of 3.5, indicating a network attack vector with low complexity, requiring user interaction, and potentially leading to low confidentiality impact through phishing or malware distribution. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.