{
  "@id": "urn:uuid:36888fad-8746-4318-8884-bf2b53504bb4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T23:59:00.126054+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T19:27:33.941409+00:00",
      "status_notes": "Vulnerability CVE-2024-11392 affects version 4.57.6.post2+tuxcare of transformers.",
      "vulnerability": {
        "name": "CVE-2024-11392"
      },
      "action_statement": "Vulnerability CVE-2024-11392 affects version 4.57.6.post2+tuxcare of transformers."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T19:27:33.941409+00:00",
      "status_notes": "Vulnerability CVE-2024-11393 affects version 4.57.6.post2+tuxcare of transformers.",
      "vulnerability": {
        "name": "CVE-2024-11393"
      },
      "action_statement": "Vulnerability CVE-2024-11393 affects version 4.57.6.post2+tuxcare of transformers."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T19:27:33.941409+00:00",
      "status_notes": "Vulnerability CVE-2024-11394 affects version 4.57.6.post2+tuxcare of transformers.",
      "vulnerability": {
        "name": "CVE-2024-11394"
      },
      "action_statement": "Vulnerability CVE-2024-11394 affects version 4.57.6.post2+tuxcare of transformers."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T19:27:33.941409+00:00",
      "status_notes": "Vulnerability CVE-2024-12720 affects version 4.57.6.post2+tuxcare of transformers.",
      "vulnerability": {
        "name": "CVE-2024-12720"
      },
      "action_statement": "Vulnerability CVE-2024-12720 affects version 4.57.6.post2+tuxcare of transformers."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T23:56:00.183573+00:00",
      "status_notes": "Vulnerability CVE-2025-1194 does not affect version 4.57.6.post2+tuxcare of transformers. not_affected \u2014 CVE-2025-1194 (ReDoS in GPT-NeoX-Japanese tokenizer) is NOT present in this target. The vulnerable regex pattern in `content_repatter6` has been replaced with safe alternatives using possessive quantifiers (Python 3.11+) or simplified patterns (Python <3.11) that prevent catastrophic backtracking. The fix was authored by upstream developer Matt (Rocketknight1@users.noreply.github.com) in commit...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-1194"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-1194 (ReDoS in GPT-NeoX-Japanese tokenizer) is NOT present in this target. The vulnerable regex pattern in `content_repatter6` has been replaced with safe alternatives using possessive quantifiers (Python 3.11+) or simplified patterns (Python <3.11) that prevent catastrophic backtracking. The fix was authored by upstream developer Matt (Rocketknight1@users.noreply.github.com) in commit..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T19:27:33.941409+00:00",
      "status_notes": "Vulnerability CVE-2025-2099 affects version 4.57.6.post2+tuxcare of transformers.",
      "vulnerability": {
        "name": "CVE-2025-2099"
      },
      "action_statement": "Vulnerability CVE-2025-2099 affects version 4.57.6.post2+tuxcare of transformers."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T23:56:36.802731+00:00",
      "status_notes": "Vulnerability CVE-2025-3263 does not affect version 4.57.6.post2+tuxcare of transformers. not_affected \u2014 The target repository (transformers 4.57.6) is NOT AFFECTED by CVE-2025-3263. The vulnerable regex pattern `config\\.(.*)\\.json` that causes ReDoS through catastrophic backtracking is not present in the target code. The fix (commit 126abe3461) replaced regex matching with simple string prefix/suffix checks (`startswith(\"config.\")` and `endswith(\".json\")`), eliminating the O(2^n) backtracking vul...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-3263"
      },
      "impact_statement": "not_affected \u2014 The target repository (transformers 4.57.6) is NOT AFFECTED by CVE-2025-3263. The vulnerable regex pattern `config\\.(.*)\\.json` that causes ReDoS through catastrophic backtracking is not present in the target code. The fix (commit 126abe3461) replaced regex matching with simple string prefix/suffix checks (`startswith(\"config.\")` and `endswith(\".json\")`), eliminating the O(2^n) backtracking vul..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T23:52:52.459677+00:00",
      "status_notes": "Vulnerability CVE-2025-3264 does not affect version 4.57.6.post2+tuxcare of transformers. not_affected \u2014 The target repository (transformers 4.57.6.post5+tuxcare) is NOT affected by CVE-2025-3264. The ReDoS vulnerability in the get_imports() function was fixed in upstream commit 126abe3461 (\"More ReDOS fixes!\") which replaced the vulnerable regex pattern `\\s*try\\s*:.*?except.*?:` with AST-based parsing. This fix was already present in upstream release 4.57.6 before TuxCare onboarded it (commit ba2...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-3264"
      },
      "impact_statement": "not_affected \u2014 The target repository (transformers 4.57.6.post5+tuxcare) is NOT affected by CVE-2025-3264. The ReDoS vulnerability in the get_imports() function was fixed in upstream commit 126abe3461 (\"More ReDOS fixes!\") which replaced the vulnerable regex pattern `\\s*try\\s*:.*?except.*?:` with AST-based parsing. This fix was already present in upstream release 4.57.6 before TuxCare onboarded it (commit ba2..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T23:56:00.183573+00:00",
      "status_notes": "Vulnerability CVE-2025-3777 does not affect version 4.57.6.post2+tuxcare of transformers. not_affected \u2014 CVE-2025-3777 is not present in the target. The vulnerability involved insecure URL validation using `startswith()` for YouTube URLs, which could be bypassed via URL username injection (e.g., `https://www.youtube.com@evil.com`). The fix was applied by Hugging Face upstream in commit 4f96081aad on April 17, 2025, replacing the vulnerable `video.startswith(\"https://www.youtube.com\")` check with s...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-3777"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-3777 is not present in the target. The vulnerability involved insecure URL validation using `startswith()` for YouTube URLs, which could be bypassed via URL username injection (e.g., `https://www.youtube.com@evil.com`). The fix was applied by Hugging Face upstream in commit 4f96081aad on April 17, 2025, replacing the vulnerable `video.startswith(\"https://www.youtube.com\")` check with s..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T23:56:00.183573+00:00",
      "status_notes": "Vulnerability CVE-2025-3933 does not affect version 4.57.6.post2+tuxcare of transformers. not_affected \u2014 CVE-2025-3933 ReDoS vulnerability is NOT present in target version 4.57.6.post5+tuxcare. The vulnerable regex pattern `<s_(.*?)>` in DonutProcessor.token2json() has been replaced with a safe two-step manual parsing approach. This fix was authored by the upstream HuggingFace team (commit ebbe9b12dd by Matt/Rocketknight1) and was already present in upstream version 4.57.6 when TuxCare onboarded i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-3933"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-3933 ReDoS vulnerability is NOT present in target version 4.57.6.post5+tuxcare. The vulnerable regex pattern `<s_(.*?)>` in DonutProcessor.token2json() has been replaced with a safe two-step manual parsing approach. This fix was authored by the upstream HuggingFace team (commit ebbe9b12dd by Matt/Rocketknight1) and was already present in upstream version 4.57.6 when TuxCare onboarded i..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T23:57:53.604864+00:00",
      "status_notes": "Vulnerability CVE-2025-5197 does not affect version 4.57.6.post2+tuxcare of transformers. not_affected \u2014 The target (transformers 4.57.6.post5+tuxcare) is not affected by CVE-2025-5197. The ReDoS vulnerability in convert_tf_weight_name_to_pt_weight_name() was fixed by upstream commit 701caef704 (authored by Matt/Rocketknight1), which added input validation at lines 81-83 to reject strings that could trigger catastrophic backtracking. This fix was already present in upstream release 4.57.6 when Tux...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-5197"
      },
      "impact_statement": "not_affected \u2014 The target (transformers 4.57.6.post5+tuxcare) is not affected by CVE-2025-5197. The ReDoS vulnerability in convert_tf_weight_name_to_pt_weight_name() was fixed by upstream commit 701caef704 (authored by Matt/Rocketknight1), which added input validation at lines 81-83 to reject strings that could trigger catastrophic backtracking. This fix was already present in upstream release 4.57.6 when Tux..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T23:59:00.126054+00:00",
      "status_notes": "Vulnerability CVE-2025-6051 does not affect version 4.57.6.post2+tuxcare of transformers. not_affected \u2014 CVE-2025-6051: ReDoS vulnerability in EnglishNormalizer.normalize_numbers() was fixed in upstream commit 54a02160eb by Matt (Rocketknight1@users.noreply.github.com) and shipped in transformers 4.57.6. The target repository at version 4.57.6 already contains this upstream fix - the vulnerable non-atomic regex quantifiers have been replaced with atomic grouping patterns ([0-9]++ instead of [0-9]+...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-6051"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-6051: ReDoS vulnerability in EnglishNormalizer.normalize_numbers() was fixed in upstream commit 54a02160eb by Matt (Rocketknight1@users.noreply.github.com) and shipped in transformers 4.57.6. The target repository at version 4.57.6 already contains this upstream fix - the vulnerable non-atomic regex quantifiers have been replaced with atomic grouping patterns ([0-9]++ instead of [0-9]+..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T19:27:33.941409+00:00",
      "status_notes": "Vulnerability CVE-2025-6638 affects version 4.57.6.post2+tuxcare of transformers.",
      "vulnerability": {
        "name": "CVE-2025-6638"
      },
      "action_statement": "Vulnerability CVE-2025-6638 affects version 4.57.6.post2+tuxcare of transformers."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T19:27:33.941409+00:00",
      "status_notes": "Vulnerability CVE-2025-6921 affects version 4.57.6.post2+tuxcare of transformers.",
      "vulnerability": {
        "name": "CVE-2025-6921"
      },
      "action_statement": "Vulnerability CVE-2025-6921 affects version 4.57.6.post2+tuxcare of transformers."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1839 is fixed in version 4.57.6.post2+tuxcare of transformers.",
      "vulnerability": {
        "name": "CVE-2026-1839"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-4372 is fixed in version 4.57.6.post2+tuxcare of transformers.",
      "vulnerability": {
        "name": "CVE-2026-4372"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-5241 affects version 4.57.6.post2+tuxcare of transformers, and is fixed in 4.57.6.post3+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-5241"
      },
      "action_statement": "Vulnerability CVE-2026-5241 affects version 4.57.6.post2+tuxcare of transformers, and is fixed in 4.57.6.post3+tuxcare."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-01T05:07:00.151595+00:00",
      "status_notes": "Vulnerability CVE-2026-80047 affects version 4.57.6.post2+tuxcare of transformers, and is fixed in 4.57.6.post5+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-80047"
      },
      "action_statement": "Vulnerability CVE-2026-80047 affects version 4.57.6.post2+tuxcare of transformers, and is fixed in 4.57.6.post5+tuxcare."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-9856 affects version 4.57.6.post2+tuxcare of transformers, and is fixed in 4.57.6.post4+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-9856"
      },
      "action_statement": "Vulnerability CVE-2026-9856 affects version 4.57.6.post2+tuxcare of transformers, and is fixed in 4.57.6.post4+tuxcare."
    }
  ]
}