{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:582a61ff-efa7-5235-a1b3-7c1e5ce23c9e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "transformers", "purl": "pkg:pypi/transformers@4.57.6.post5+tuxcare", "type": "library", "bom-ref": "pkg:pypi/transformers@4.57.6.post5+tuxcare", "version": "4.57.6.post5+tuxcare", "pedigree": { "ancestors": [ { "name": "transformers", "purl": "pkg:pypi/transformers@4.57.6", "type": "library", "version": "4.57.6" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-11392", "affects": [ { "ref": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } ], "bom-ref": "urn:uuid:2082b972-0a6a-5234-8710-8648ee967bed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-11392 affects version 4.57.6.post5+tuxcare of transformers." } }, { "id": "CVE-2024-11393", "affects": [ { "ref": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } ], "bom-ref": "urn:uuid:47bfa79c-d66e-5aaf-8e23-7bafe9e96ad0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-11393 affects version 4.57.6.post5+tuxcare of transformers." } }, { "id": "CVE-2024-11394", "affects": [ { "ref": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } ], "bom-ref": "urn:uuid:c0e45bd4-c24e-55f9-9339-503150f7c509", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-11394 affects version 4.57.6.post5+tuxcare of transformers." } }, { "id": "CVE-2024-12720", "affects": [ { "ref": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } ], "bom-ref": "urn:uuid:3b9c709d-052a-5826-abd7-a393453d33dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-12720 affects version 4.57.6.post5+tuxcare of transformers." } }, { "id": "CVE-2025-1194", "affects": [ { "ref": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } ], "bom-ref": "urn:uuid:bb31a4a4-6b68-59f8-aafa-28f4b2175565", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-1194 does not affect version 4.57.6.post5+tuxcare of transformers. not_affected \u2014 CVE-2025-1194 (ReDoS in GPT-NeoX-Japanese tokenizer) is NOT present in this target. The vulnerable regex pattern in `content_repatter6` has been replaced with safe alternatives using possessive quantifiers (Python 3.11+) or simplified patterns (Python <3.11) that prevent catastrophic backtracking. The fix was authored by upstream developer Matt (Rocketknight1@users.noreply.github.com) in commit...", "justification": "code_not_present" } }, { "id": "CVE-2025-2099", "affects": [ { "ref": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } ], "bom-ref": "urn:uuid:e23006b7-d688-5942-b13f-e4f8ae1baba7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-2099 affects version 4.57.6.post5+tuxcare of transformers." } }, { "id": "CVE-2025-3263", "affects": [ { "ref": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } ], "bom-ref": "urn:uuid:4c5f6c22-a3b0-5ae1-8e7b-e224a422bc98", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-3263 does not affect version 4.57.6.post5+tuxcare of transformers. not_affected \u2014 The target repository (transformers 4.57.6) is NOT AFFECTED by CVE-2025-3263. The vulnerable regex pattern `config\\.(.*)\\.json` that causes ReDoS through catastrophic backtracking is not present in the target code. The fix (commit 126abe3461) replaced regex matching with simple string prefix/suffix checks (`startswith(\"config.\")` and `endswith(\".json\")`), eliminating the O(2^n) backtracking vul...", "justification": "code_not_present" } }, { "id": "CVE-2025-3264", "affects": [ { "ref": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } ], "bom-ref": "urn:uuid:cd96ead2-9752-5999-9419-f440bed2a378", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-3264 does not affect version 4.57.6.post5+tuxcare of transformers. not_affected \u2014 The target repository (transformers 4.57.6.post5+tuxcare) is NOT affected by CVE-2025-3264. The ReDoS vulnerability in the get_imports() function was fixed in upstream commit 126abe3461 (\"More ReDOS fixes!\") which replaced the vulnerable regex pattern `\\s*try\\s*:.*?except.*?:` with AST-based parsing. This fix was already present in upstream release 4.57.6 before TuxCare onboarded it (commit ba2...", "justification": "code_not_present" } }, { "id": "CVE-2025-3777", "affects": [ { "ref": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } ], "bom-ref": "urn:uuid:0614d9cf-79f9-532f-839e-5fc65cf98e41", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-3777 does not affect version 4.57.6.post5+tuxcare of transformers. not_affected \u2014 CVE-2025-3777 is not present in the target. The vulnerability involved insecure URL validation using `startswith()` for YouTube URLs, which could be bypassed via URL username injection (e.g., `https://www.youtube.com@evil.com`). The fix was applied by Hugging Face upstream in commit 4f96081aad on April 17, 2025, replacing the vulnerable `video.startswith(\"https://www.youtube.com\")` check with s...", "justification": "code_not_present" } }, { "id": "CVE-2025-3933", "affects": [ { "ref": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } ], "bom-ref": "urn:uuid:6ad94df3-9c8c-5696-9882-19e6da1ba8fc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-3933 does not affect version 4.57.6.post5+tuxcare of transformers. not_affected \u2014 CVE-2025-3933 ReDoS vulnerability is NOT present in target version 4.57.6.post5+tuxcare. The vulnerable regex pattern `` in DonutProcessor.token2json() has been replaced with a safe two-step manual parsing approach. This fix was authored by the upstream HuggingFace team (commit ebbe9b12dd by Matt/Rocketknight1) and was already present in upstream version 4.57.6 when TuxCare onboarded i...", "justification": "code_not_present" } }, { "id": "CVE-2025-5197", "affects": [ { "ref": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } ], "bom-ref": "urn:uuid:3de6a26b-7129-5ec6-91d4-4b3ca8cf0087", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-5197 does not affect version 4.57.6.post5+tuxcare of transformers. not_affected \u2014 The target (transformers 4.57.6.post5+tuxcare) is not affected by CVE-2025-5197. The ReDoS vulnerability in convert_tf_weight_name_to_pt_weight_name() was fixed by upstream commit 701caef704 (authored by Matt/Rocketknight1), which added input validation at lines 81-83 to reject strings that could trigger catastrophic backtracking. This fix was already present in upstream release 4.57.6 when Tux...", "justification": "code_not_present" } }, { "id": "CVE-2025-6051", "affects": [ { "ref": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } ], "bom-ref": "urn:uuid:6a1c0bbd-be04-5cf3-9c15-6437e8cbd16c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-6051 does not affect version 4.57.6.post5+tuxcare of transformers. not_affected \u2014 CVE-2025-6051: ReDoS vulnerability in EnglishNormalizer.normalize_numbers() was fixed in upstream commit 54a02160eb by Matt (Rocketknight1@users.noreply.github.com) and shipped in transformers 4.57.6. The target repository at version 4.57.6 already contains this upstream fix - the vulnerable non-atomic regex quantifiers have been replaced with atomic grouping patterns ([0-9]++ instead of [0-9]+...", "justification": "code_not_present" } }, { "id": "CVE-2025-6638", "affects": [ { "ref": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } ], "bom-ref": "urn:uuid:81b11615-df0f-5763-9a23-719404f510b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-6638 affects version 4.57.6.post5+tuxcare of transformers." } }, { "id": "CVE-2025-6921", "affects": [ { "ref": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } ], "bom-ref": "urn:uuid:84d73609-6f2f-54ef-93a4-09db75089d8d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-6921 affects version 4.57.6.post5+tuxcare of transformers." } }, { "id": "CVE-2026-1839", "affects": [ { "ref": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } ], "bom-ref": "urn:uuid:59949c01-633a-5c83-a113-8ea763808667", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-1839 is fixed in version 4.57.6.post5+tuxcare of transformers." } }, { "id": "CVE-2026-4372", "affects": [ { "ref": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } ], "bom-ref": "urn:uuid:68f715b8-9659-5e2b-bd05-309746b41cc9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-4372 is fixed in version 4.57.6.post5+tuxcare of transformers." } }, { "id": "CVE-2026-5241", "affects": [ { "ref": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } ], "bom-ref": "urn:uuid:420df650-d395-5466-8823-cd4d48d14416", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5241 is fixed in version 4.57.6.post5+tuxcare of transformers." } }, { "id": "CVE-2026-80047", "affects": [ { "ref": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } ], "bom-ref": "urn:uuid:5d5331c1-8b94-580a-af1b-aa86ecf84404", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-80047 is fixed in version 4.57.6.post5+tuxcare of transformers." } }, { "id": "CVE-2026-9856", "affects": [ { "ref": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } ], "bom-ref": "urn:uuid:bf4bd2de-7b38-58a0-9192-88eb746a1e8f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-9856 is fixed in version 4.57.6.post5+tuxcare of transformers." } } ], "dependencies": [ { "ref": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } ] }