{"schemaVersion":"ki-abhaengigkeitsatlas/v1","dataset":"german-public-sector-ai-dependency-atlas","parserVersion":"1","generatedAt":"2026-07-20T14:37:29.537Z","trackingSince":"2026-07-18T21:20:30.334Z","source":{"codeRadar":{"dataset":"german-public-sector-ai-code-radar","generatedAt":"2026-07-20T14:36:19.763Z","parserVersion":"3","url":"https://i6eal.de/tools/ki-code-radar/"},"openCode":{"label":"openCode GitLab","url":"https://gitlab.opencode.de/"},"depsDev":{"label":"deps.dev API v3","url":"https://docs.deps.dev/api/v3/"},"osv":{"label":"OSV API","url":"https://google.github.io/osv.dev/api/"},"spdx":{"label":"SPDX License List","url":"https://spdx.org/licenses/","version":"3.28.0","releaseDate":"2026-02-20T00:00:00Z"}},"coverage":{"repositoryCount":30,"completeTreeCount":29,"incompleteTreeCount":1,"lockfileRepositoryCount":17,"sbomRepositoryCount":4,"artifactRepositoryCount":20,"resolvedRepositoryCount":29,"resolvedArtifactRepositoryCount":20,"dependencyFileCount":33,"parsedFileCount":32,"parseErrorCount":1,"unsupportedFileCount":0,"evaluatedVersionCount":4205,"metadataResolvedCount":4191,"metadataNotFoundCount":14,"osvEvaluatedVersionCount":4205,"codeRadarRepositoryCount":30},"methodology":{"componentParserSchemaVersion":"ki-dependency-atlas-components/v1","candidateBoundary":"repositories_with_exact_ai_code_evidence","resolvedVersionBoundary":"exact_lockfile_or_sbom_component_or_exact_double_equals_manifest_pin","manifestRangesResolved":false,"latestVersionSubstitution":false,"containerTagsVulnerabilityChecked":false,"osvClaim":"osv_matched_observed_resolved_package_version_at_collection_time","depsDevLicenseSemantics":"spdx_expressions_as_reported_without_inferred_compatibility","providerSemantics":"package_interface_presence_not_api_configuration_procurement_or_use","generativeAiUsed":false,"scoreUsed":false,"treeEntryCeiling":2500,"fileByteCeiling":5242880,"uniqueVersionCeiling":5000,"observedFormats":["package-lock.json / npm-shrinkwrap.json","uv.lock","poetry.lock","Pipfile.lock","CycloneDX JSON","SPDX JSON or YAML","exact == manifest pins"]},"summary":{"repositoryCount":30,"packageCount":2831,"aiPackageCount":41,"resolvedComponentCount":7181,"resolvedVersionCount":4205,"providerExposureRepositoryCount":7,"licenseExpressionCount":57,"knownLicensePackageCount":2796,"unknownLicensePackageCount":35,"advisoryCount":572,"matchedAdvisoryRepositoryCount":25,"topPackage":{"id":"package:pypi:openai","slug":"openai-0dd26ac5","label":"OpenAI SDK","repositoryCount":18,"repositoryShare":0.6}},"kind":"paket","entity":{"id":"package:pypi:transformers","slug":"transformers-65289303","identity":"pypi:transformers","ecosystem":"pypi","name":"transformers","label":"Transformers","category":"model-runtime","aiRelevant":true,"provider":{"id":"hugging-face","label":"Hugging Face"},"repositoryCount":8,"occurrenceCount":11,"directRepositoryCount":0,"versionCount":7,"licenseExpressions":["Apache-2.0"],"advisoryIds":["GHSA-29pf-2h5f-8g72","GHSA-37mw-44qp-f5jm","GHSA-4w7r-h757-3r74","GHSA-59p9-h35m-wg4g","GHSA-69w3-r845-3855","GHSA-6rvg-6v2m-4j46","GHSA-9356-575x-2w9m","GHSA-fgcw-684q-jj6r","GHSA-fpwr-67px-3qhx","GHSA-hxxf-235m-72v3","GHSA-jjph-296x-mrcr","GHSA-phhr-52qp-3mj4","GHSA-q2wp-rjmx-x6x9","GHSA-qq3j-4f4f-9583","GHSA-qxrp-vhvm-j765","GHSA-rcv9-qm8p-9p6j","GHSA-wrfc-pvp9-mr9g","PYSEC-2025-211","PYSEC-2025-212","PYSEC-2025-213","PYSEC-2025-214","PYSEC-2025-215","PYSEC-2025-216","PYSEC-2025-217","PYSEC-2025-218"],"advisoryCount":25,"verifiedAttestation":false,"repositories":[{"id":"opencode:8712","slug":"opencode-8712","name":"F13-RAG","pathWithNamespace":"landeshauptstadt-muenchen/f-13-rag","versions":["4.57.3"],"evidenceCount":4},{"id":"opencode:7674","slug":"opencode-7674","name":"Coding Agent Usage Simulation","pathWithNamespace":"uba-ki-lab/coding-agent-usage-simulation","versions":["4.57.1"],"evidenceCount":1},{"id":"opencode:5530","slug":"opencode-5530","name":"GSA Extraction","pathWithNamespace":"uba-ki-lab/gsa-extraction","versions":["4.53.1"],"evidenceCount":1},{"id":"opencode:10787","slug":"opencode-10787","name":"LLM Questionnaire Benchmarking Framework","pathWithNamespace":"uba-ki-lab/llm-questionnaire-benchmarking-framework","versions":["4.57.6"],"evidenceCount":1},{"id":"opencode:5012","slug":"opencode-5012","name":"LLM Testframework","pathWithNamespace":"uba-ki-lab/llm-testframework","versions":["4.51.3"],"evidenceCount":1},{"id":"opencode:4112","slug":"opencode-4112","name":"Objection management","pathWithNamespace":"uba-ki-lab/objection-management","versions":["4.47.1"],"evidenceCount":1},{"id":"opencode:10775","slug":"opencode-10775","name":"Ressource Efficient Computer Vision","pathWithNamespace":"uba-ki-lab/ressource-efficient-computer-vision","versions":["4.57.4"],"evidenceCount":1},{"id":"opencode:7811","slug":"opencode-7811","name":"Retrieval Evaluation","pathWithNamespace":"uba-ki-lab/retrieval-evaluation","versions":["4.57.1"],"evidenceCount":1}],"versions":[{"version":"4.47.1","repositoryCount":1,"occurrenceCount":1,"ageDays":579,"advisoryIds":["GHSA-29pf-2h5f-8g72","GHSA-37mw-44qp-f5jm","GHSA-4w7r-h757-3r74","GHSA-59p9-h35m-wg4g","GHSA-69w3-r845-3855","GHSA-6rvg-6v2m-4j46","GHSA-9356-575x-2w9m","GHSA-fgcw-684q-jj6r","GHSA-fpwr-67px-3qhx","GHSA-hxxf-235m-72v3","GHSA-jjph-296x-mrcr","GHSA-phhr-52qp-3mj4","GHSA-q2wp-rjmx-x6x9","GHSA-qq3j-4f4f-9583","GHSA-qxrp-vhvm-j765","GHSA-rcv9-qm8p-9p6j","GHSA-wrfc-pvp9-mr9g","PYSEC-2025-211","PYSEC-2025-212","PYSEC-2025-213","PYSEC-2025-214","PYSEC-2025-215","PYSEC-2025-216","PYSEC-2025-217","PYSEC-2025-218"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2024-12-17T15:42:35Z","deprecated":false,"deprecatedReason":null,"licenses":["Apache-2.0"],"advisoryIds":["GHSA-29pf-2h5f-8g72","GHSA-37mw-44qp-f5jm","GHSA-4w7r-h757-3r74","GHSA-59p9-h35m-wg4g","GHSA-69w3-r845-3855","GHSA-6rvg-6v2m-4j46","GHSA-9356-575x-2w9m","GHSA-fgcw-684q-jj6r","GHSA-fpwr-67px-3qhx","GHSA-hxxf-235m-72v3","GHSA-jjph-296x-mrcr","GHSA-phhr-52qp-3mj4","GHSA-q2wp-rjmx-x6x9","GHSA-qq3j-4f4f-9583","GHSA-qxrp-vhvm-j765","GHSA-rcv9-qm8p-9p6j","GHSA-wrfc-pvp9-mr9g","PYSEC-2024-227","PYSEC-2024-228","PYSEC-2024-229","PYSEC-2025-211","PYSEC-2025-212","PYSEC-2025-213","PYSEC-2025-214","PYSEC-2025-215","PYSEC-2025-216","PYSEC-2025-217","PYSEC-2025-218","PYSEC-2025-40","PYSEC-2026-1977","PYSEC-2026-1980","PYSEC-2026-1981","PYSEC-2026-1982","PYSEC-2026-1983","PYSEC-2026-1984","PYSEC-2026-1985","PYSEC-2026-1986","PYSEC-2026-1987","PYSEC-2026-1988","PYSEC-2026-2288","PYSEC-2026-2289","PYSEC-2026-2290"],"links":[{"label":"SOURCE_REPO","url":"https://github.com/huggingface/transformers"}],"relatedProjects":[{"id":"github.com/huggingface/transformers","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"}],"attestations":[],"verifiedAttestation":false,"projectStatus":"active"}},{"version":"4.51.3","repositoryCount":1,"occurrenceCount":1,"ageDays":462,"advisoryIds":["GHSA-29pf-2h5f-8g72","GHSA-37mw-44qp-f5jm","GHSA-4w7r-h757-3r74","GHSA-59p9-h35m-wg4g","GHSA-69w3-r845-3855","GHSA-9356-575x-2w9m","GHSA-fgcw-684q-jj6r","GHSA-phhr-52qp-3mj4","GHSA-rcv9-qm8p-9p6j","PYSEC-2025-211","PYSEC-2025-212","PYSEC-2025-213","PYSEC-2025-214","PYSEC-2025-215","PYSEC-2025-216","PYSEC-2025-217","PYSEC-2025-218"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2025-04-14T08:13:43Z","deprecated":false,"deprecatedReason":null,"licenses":["Apache-2.0"],"advisoryIds":["GHSA-29pf-2h5f-8g72","GHSA-37mw-44qp-f5jm","GHSA-4w7r-h757-3r74","GHSA-59p9-h35m-wg4g","GHSA-69w3-r845-3855","GHSA-9356-575x-2w9m","GHSA-fgcw-684q-jj6r","GHSA-phhr-52qp-3mj4","GHSA-rcv9-qm8p-9p6j","PYSEC-2025-211","PYSEC-2025-212","PYSEC-2025-213","PYSEC-2025-214","PYSEC-2025-215","PYSEC-2025-216","PYSEC-2025-217","PYSEC-2025-218","PYSEC-2026-1977","PYSEC-2026-1980","PYSEC-2026-1981","PYSEC-2026-1983","PYSEC-2026-1986","PYSEC-2026-1988","PYSEC-2026-2288","PYSEC-2026-2289","PYSEC-2026-2290"],"links":[{"label":"SOURCE_REPO","url":"https://github.com/huggingface/transformers"}],"relatedProjects":[{"id":"github.com/huggingface/transformers","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"}],"attestations":[],"verifiedAttestation":false,"projectStatus":"active"}},{"version":"4.53.1","repositoryCount":1,"occurrenceCount":1,"ageDays":381,"advisoryIds":["GHSA-29pf-2h5f-8g72","GHSA-69w3-r845-3855","GHSA-fgcw-684q-jj6r","PYSEC-2025-211","PYSEC-2025-212","PYSEC-2025-213","PYSEC-2025-214","PYSEC-2025-215","PYSEC-2025-216","PYSEC-2025-217","PYSEC-2025-218"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2025-07-04T08:28:37Z","deprecated":false,"deprecatedReason":null,"licenses":["Apache-2.0"],"advisoryIds":["GHSA-29pf-2h5f-8g72","GHSA-69w3-r845-3855","GHSA-fgcw-684q-jj6r","PYSEC-2025-211","PYSEC-2025-212","PYSEC-2025-213","PYSEC-2025-214","PYSEC-2025-215","PYSEC-2025-216","PYSEC-2025-217","PYSEC-2025-218","PYSEC-2026-2288","PYSEC-2026-2289","PYSEC-2026-2290"],"links":[{"label":"SOURCE_REPO","url":"https://github.com/huggingface/transformers"}],"relatedProjects":[{"id":"github.com/huggingface/transformers","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"}],"attestations":[],"verifiedAttestation":false,"projectStatus":"active"}},{"version":"4.57.1","repositoryCount":2,"occurrenceCount":2,"ageDays":278,"advisoryIds":["GHSA-29pf-2h5f-8g72","GHSA-69w3-r845-3855","GHSA-fgcw-684q-jj6r","PYSEC-2025-217","PYSEC-2025-218"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2025-10-14T15:39:23Z","deprecated":false,"deprecatedReason":null,"licenses":["Apache-2.0"],"advisoryIds":["GHSA-29pf-2h5f-8g72","GHSA-69w3-r845-3855","GHSA-fgcw-684q-jj6r","PYSEC-2025-217","PYSEC-2025-218","PYSEC-2026-2288","PYSEC-2026-2289","PYSEC-2026-2290"],"links":[{"label":"SOURCE_REPO","url":"https://github.com/huggingface/transformers"}],"relatedProjects":[{"id":"github.com/huggingface/transformers","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"}],"attestations":[],"verifiedAttestation":false,"projectStatus":"active"}},{"version":"4.57.3","repositoryCount":1,"occurrenceCount":4,"ageDays":236,"advisoryIds":["GHSA-29pf-2h5f-8g72","GHSA-69w3-r845-3855","GHSA-fgcw-684q-jj6r","PYSEC-2025-217"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2025-11-25T15:51:26Z","deprecated":false,"deprecatedReason":null,"licenses":["Apache-2.0"],"advisoryIds":["GHSA-29pf-2h5f-8g72","GHSA-69w3-r845-3855","GHSA-fgcw-684q-jj6r","PYSEC-2025-217","PYSEC-2026-2288","PYSEC-2026-2289","PYSEC-2026-2290"],"links":[{"label":"SOURCE_REPO","url":"https://github.com/huggingface/transformers"}],"relatedProjects":[{"id":"github.com/huggingface/transformers","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"}],"attestations":[],"verifiedAttestation":false,"projectStatus":"active"}},{"version":"4.57.4","repositoryCount":1,"occurrenceCount":1,"ageDays":188,"advisoryIds":["GHSA-29pf-2h5f-8g72","GHSA-69w3-r845-3855","GHSA-fgcw-684q-jj6r","PYSEC-2025-217"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2026-01-13T11:04:40Z","deprecated":false,"deprecatedReason":null,"licenses":["Apache-2.0"],"advisoryIds":["GHSA-29pf-2h5f-8g72","GHSA-69w3-r845-3855","GHSA-fgcw-684q-jj6r","PYSEC-2025-217","PYSEC-2026-2288","PYSEC-2026-2289","PYSEC-2026-2290"],"links":[{"label":"SOURCE_REPO","url":"https://github.com/huggingface/transformers"}],"relatedProjects":[{"id":"github.com/huggingface/transformers","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"}],"attestations":[],"verifiedAttestation":false,"projectStatus":"active"}},{"version":"4.57.6","repositoryCount":1,"occurrenceCount":1,"ageDays":185,"advisoryIds":["GHSA-29pf-2h5f-8g72","GHSA-69w3-r845-3855","GHSA-fgcw-684q-jj6r","PYSEC-2025-217"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2026-01-16T10:38:31Z","deprecated":false,"deprecatedReason":null,"licenses":["Apache-2.0"],"advisoryIds":["GHSA-29pf-2h5f-8g72","GHSA-69w3-r845-3855","GHSA-fgcw-684q-jj6r","PYSEC-2025-217","PYSEC-2026-2288","PYSEC-2026-2289","PYSEC-2026-2290"],"links":[{"label":"SOURCE_REPO","url":"https://github.com/huggingface/transformers"}],"relatedProjects":[{"id":"github.com/huggingface/transformers","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"}],"attestations":[],"verifiedAttestation":false,"projectStatus":"active"}}]},"evidence":{"occurrences":[{"id":"component:395be99a5328f264667dc515","repositoryId":"opencode:7674","repositorySlug":"opencode-7674","repositoryName":"Coding Agent Usage Simulation","repositoryPathWithNamespace":"uba-ki-lab/coding-agent-usage-simulation","ecosystem":"pypi","name":"transformers","identity":"pypi:transformers","version":"4.57.1","versionKey":"pypi:transformers@4.57.1","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"uv.lock","blobSha":"1b1464cf01496db34285bf91f7841aed50559816","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/coding-agent-usage-simulation/-/blob/fe8ab81af4926a34c6cf1f3a807ffeda2b398f32/uv.lock","commitSha":"fe8ab81af4926a34c6cf1f3a807ffeda2b398f32"},{"id":"component:fbf0f55fa357a51198ac661d","repositoryId":"opencode:8712","repositorySlug":"opencode-8712","repositoryName":"F13-RAG","repositoryPathWithNamespace":"landeshauptstadt-muenchen/f-13-rag","ecosystem":"pypi","name":"transformers","identity":"pypi:transformers","version":"4.57.3","versionKey":"pypi:transformers@4.57.3","direct":false,"development":false,"sourceKind":"exact-manifest-pin","filePath":"requirements-dev.txt","blobSha":"76efb9a752987481ba23ef081e7e3a05d59ed513","sourceUrl":"https://gitlab.opencode.de/landeshauptstadt-muenchen/f-13-rag/-/blob/ddae51bb41a08acf9c1bcdee5dc8ce92df04649c/requirements-dev.txt","commitSha":"ddae51bb41a08acf9c1bcdee5dc8ce92df04649c"},{"id":"component:a12ccf7f1c803c76a6843ed7","repositoryId":"opencode:8712","repositorySlug":"opencode-8712","repositoryName":"F13-RAG","repositoryPathWithNamespace":"landeshauptstadt-muenchen/f-13-rag","ecosystem":"pypi","name":"transformers","identity":"pypi:transformers","version":"4.57.3","versionKey":"pypi:transformers@4.57.3","direct":false,"development":false,"sourceKind":"exact-manifest-pin","filePath":"requirements-gpu.txt","blobSha":"8c2dfe24b230ff6ad5cc0779e7e45ce51a1e20a1","sourceUrl":"https://gitlab.opencode.de/landeshauptstadt-muenchen/f-13-rag/-/blob/ddae51bb41a08acf9c1bcdee5dc8ce92df04649c/requirements-gpu.txt","commitSha":"ddae51bb41a08acf9c1bcdee5dc8ce92df04649c"},{"id":"component:a6094080ecd81390ad348adc","repositoryId":"opencode:8712","repositorySlug":"opencode-8712","repositoryName":"F13-RAG","repositoryPathWithNamespace":"landeshauptstadt-muenchen/f-13-rag","ecosystem":"pypi","name":"transformers","identity":"pypi:transformers","version":"4.57.3","versionKey":"pypi:transformers@4.57.3","direct":false,"development":false,"sourceKind":"exact-manifest-pin","filePath":"requirements-testing.txt","blobSha":"a62dcf771b99cedee4157c93a2e50d10f678e585","sourceUrl":"https://gitlab.opencode.de/landeshauptstadt-muenchen/f-13-rag/-/blob/ddae51bb41a08acf9c1bcdee5dc8ce92df04649c/requirements-testing.txt","commitSha":"ddae51bb41a08acf9c1bcdee5dc8ce92df04649c"},{"id":"component:1cf39a2552c7bf1805db6df0","repositoryId":"opencode:8712","repositorySlug":"opencode-8712","repositoryName":"F13-RAG","repositoryPathWithNamespace":"landeshauptstadt-muenchen/f-13-rag","ecosystem":"pypi","name":"transformers","identity":"pypi:transformers","version":"4.57.3","versionKey":"pypi:transformers@4.57.3","direct":false,"development":false,"sourceKind":"exact-manifest-pin","filePath":"requirements.txt","blobSha":"da215299c628b804b28789cb8267236418948d82","sourceUrl":"https://gitlab.opencode.de/landeshauptstadt-muenchen/f-13-rag/-/blob/ddae51bb41a08acf9c1bcdee5dc8ce92df04649c/requirements.txt","commitSha":"ddae51bb41a08acf9c1bcdee5dc8ce92df04649c"},{"id":"component:0444c983afc1c7181c1da8e2","repositoryId":"opencode:5530","repositorySlug":"opencode-5530","repositoryName":"GSA Extraction","repositoryPathWithNamespace":"uba-ki-lab/gsa-extraction","ecosystem":"pypi","name":"transformers","identity":"pypi:transformers","version":"4.53.1","versionKey":"pypi:transformers@4.53.1","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"uv.lock","blobSha":"fbb23733e647554b5678500b3f17f13bac7f77f5","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/gsa-extraction/-/blob/f5161e79d3f8c53877f9b1b0d72e1c10bff775ba/uv.lock","commitSha":"f5161e79d3f8c53877f9b1b0d72e1c10bff775ba"},{"id":"component:2fe8dcf72a2ed6b598e18dd1","repositoryId":"opencode:10787","repositorySlug":"opencode-10787","repositoryName":"LLM Questionnaire Benchmarking Framework","repositoryPathWithNamespace":"uba-ki-lab/llm-questionnaire-benchmarking-framework","ecosystem":"pypi","name":"transformers","identity":"pypi:transformers","version":"4.57.6","versionKey":"pypi:transformers@4.57.6","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"uv.lock","blobSha":"1b55661fee93d4733461df8e9c2b491b9205aac2","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/llm-questionnaire-benchmarking-framework/-/blob/4e12ee9f3b0b6fdc77fe21cb89e6cfac17dc6ebd/uv.lock","commitSha":"4e12ee9f3b0b6fdc77fe21cb89e6cfac17dc6ebd"},{"id":"component:78195b67a2c175e3450ff0ef","repositoryId":"opencode:5012","repositorySlug":"opencode-5012","repositoryName":"LLM Testframework","repositoryPathWithNamespace":"uba-ki-lab/llm-testframework","ecosystem":"pypi","name":"transformers","identity":"pypi:transformers","version":"4.51.3","versionKey":"pypi:transformers@4.51.3","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"uv.lock","blobSha":"b4c29eab16a40db016821e4ea567956048a046ea","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/llm-testframework/-/blob/e8d6e99a1fa63b264e727acb553ed9b1499789b1/uv.lock","commitSha":"e8d6e99a1fa63b264e727acb553ed9b1499789b1"},{"id":"component:07e6d714743f77c8dacbbd3f","repositoryId":"opencode:4112","repositorySlug":"opencode-4112","repositoryName":"Objection management","repositoryPathWithNamespace":"uba-ki-lab/objection-management","ecosystem":"pypi","name":"transformers","identity":"pypi:transformers","version":"4.47.1","versionKey":"pypi:transformers@4.47.1","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"uv.lock","blobSha":"8515db65670904208e99397a2d7878af759c74f3","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/objection-management/-/blob/5c1425bf9990cf12c5ae8ada47d249710703af18/uv.lock","commitSha":"5c1425bf9990cf12c5ae8ada47d249710703af18"},{"id":"component:bec14d97b4bcaa8d5c3cd7c3","repositoryId":"opencode:10775","repositorySlug":"opencode-10775","repositoryName":"Ressource Efficient Computer Vision","repositoryPathWithNamespace":"uba-ki-lab/ressource-efficient-computer-vision","ecosystem":"pypi","name":"transformers","identity":"pypi:transformers","version":"4.57.4","versionKey":"pypi:transformers@4.57.4","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"uv.lock","blobSha":"047f47304acd18a48770c101f5a8383cd19bb134","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/ressource-efficient-computer-vision/-/blob/9aa07461b879a6161b7e901ea4c2a382b8f1b4ae/uv.lock","commitSha":"9aa07461b879a6161b7e901ea4c2a382b8f1b4ae"},{"id":"component:a51c3ed3ad058dae4245dc1b","repositoryId":"opencode:7811","repositorySlug":"opencode-7811","repositoryName":"Retrieval Evaluation","repositoryPathWithNamespace":"uba-ki-lab/retrieval-evaluation","ecosystem":"pypi","name":"transformers","identity":"pypi:transformers","version":"4.57.1","versionKey":"pypi:transformers@4.57.1","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"uv.lock","blobSha":"20c0181bf785c3e980512ba2de16e0fe3f207bad","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/retrieval-evaluation/-/blob/f64bf528432908908d92b8263d6933301033bb7f/uv.lock","commitSha":"f64bf528432908908d92b8263d6933301033bb7f"}],"occurrenceCount":11},"related":{"repositories":[{"id":"opencode:8712","slug":"opencode-8712","name":"F13-RAG","pathWithNamespace":"landeshauptstadt-muenchen/f-13-rag","versions":["4.57.3"],"evidenceCount":4},{"id":"opencode:7674","slug":"opencode-7674","name":"Coding Agent Usage Simulation","pathWithNamespace":"uba-ki-lab/coding-agent-usage-simulation","versions":["4.57.1"],"evidenceCount":1},{"id":"opencode:5530","slug":"opencode-5530","name":"GSA Extraction","pathWithNamespace":"uba-ki-lab/gsa-extraction","versions":["4.53.1"],"evidenceCount":1},{"id":"opencode:10787","slug":"opencode-10787","name":"LLM Questionnaire Benchmarking Framework","pathWithNamespace":"uba-ki-lab/llm-questionnaire-benchmarking-framework","versions":["4.57.6"],"evidenceCount":1},{"id":"opencode:5012","slug":"opencode-5012","name":"LLM Testframework","pathWithNamespace":"uba-ki-lab/llm-testframework","versions":["4.51.3"],"evidenceCount":1},{"id":"opencode:4112","slug":"opencode-4112","name":"Objection management","pathWithNamespace":"uba-ki-lab/objection-management","versions":["4.47.1"],"evidenceCount":1},{"id":"opencode:10775","slug":"opencode-10775","name":"Ressource Efficient Computer Vision","pathWithNamespace":"uba-ki-lab/ressource-efficient-computer-vision","versions":["4.57.4"],"evidenceCount":1},{"id":"opencode:7811","slug":"opencode-7811","name":"Retrieval Evaluation","pathWithNamespace":"uba-ki-lab/retrieval-evaluation","versions":["4.57.1"],"evidenceCount":1}],"vulnerabilities":[{"id":"GHSA-29pf-2h5f-8g72","slug":"ghsa-29pf-2h5f-8g72-1d83ebb4","dossier":false,"summary":"HuggingFace transformers vulnerable to remote code execution","aliases":["CVE-2026-4372","PYSEC-2026-2289"],"sourceIds":["GHSA-29pf-2h5f-8g72","PYSEC-2026-2289"],"published":"2026-05-24T14:16:16.917Z","modified":"2026-07-13T16:45:06.535860363Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4372"},{"type":"FIX","url":"https://github.com/huggingface/transformers/commit/a7f8e7ff37d87d1a1a0c8cf607971c607741452f"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"EVIDENCE","url":"https://huntr.com/bounties/1f693a6e-6836-4b8b-a0bd-ca036fba8884"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-29pf-2h5f-8g72"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3","pypi:transformers@4.53.1","pypi:transformers@4.57.1","pypi:transformers@4.57.3","pypi:transformers@4.57.4","pypi:transformers@4.57.6"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-37mw-44qp-f5jm","slug":"ghsa-37mw-44qp-f5jm-fb05555e","dossier":false,"summary":"Transformers is vulnerable to ReDoS attack through its DonutProcessor class","aliases":["CVE-2025-3933","PYSEC-2026-1977"],"sourceIds":["GHSA-37mw-44qp-f5jm","PYSEC-2026-1977"],"published":"2025-07-11T12:30:32Z","modified":"2026-07-07T17:57:16.879129924Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3933"},{"type":"WEB","url":"https://github.com/huggingface/transformers/pull/37788"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/ebbe9b12dd75b69f92100d684c47f923ee262a93"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/25282953-5827-4384-bb6f-5790d275721b"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-37mw-44qp-f5jm"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-4w7r-h757-3r74","slug":"ghsa-4w7r-h757-3r74-ca8973bc","dossier":false,"summary":"Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer","aliases":["CVE-2025-6921","PYSEC-2026-1980"],"sourceIds":["GHSA-4w7r-h757-3r74","PYSEC-2026-1980"],"published":"2025-09-23T15:31:09Z","modified":"2026-07-07T17:57:12.050585329Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6921"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/47c34fba5c303576560cb29767efb452ff12b8be"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/d37f7517972f67e3f2194c000ed0f87f064e5099"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/287d15a7-6e7c-45d2-8c05-11e305776f1f"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-4w7r-h757-3r74"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-59p9-h35m-wg4g","slug":"ghsa-59p9-h35m-wg4g-68657c65","dossier":false,"summary":"Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer","aliases":["CVE-2025-6638","PYSEC-2026-1981"],"sourceIds":["GHSA-59p9-h35m-wg4g","PYSEC-2026-1981"],"published":"2025-09-12T12:30:23Z","modified":"2026-07-07T17:56:49.269701149Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6638"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/47c34fba5c303576560cb29767efb452ff12b8be"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/d37f7517972f67e3f2194c000ed0f87f064e5099"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/6a6c933f-9ce8-4ded-8b3b-2c1444c61f36"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-59p9-h35m-wg4g"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-69w3-r845-3855","slug":"ghsa-69w3-r845-3855-1b4edc28","dossier":false,"summary":"HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class","aliases":["CVE-2026-1839","PYSEC-2026-2288"],"sourceIds":["GHSA-69w3-r845-3855","PYSEC-2026-2288"],"published":"2026-04-07T06:16:41.490Z","modified":"2026-07-13T16:45:06.516869221Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1839"},{"type":"FIX","url":"https://github.com/huggingface/transformers/commit/03c8082ba4594c9b8d6fe190ca9bed0e5f8ca396"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://github.com/huggingface/transformers/releases/tag/v5.0.0rc3"},{"type":"EVIDENCE","url":"https://huntr.com/bounties/3c77bb97-e493-493d-9a88-c57f5c536485"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-69w3-r845-3855"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3","pypi:transformers@4.53.1","pypi:transformers@4.57.1","pypi:transformers@4.57.3","pypi:transformers@4.57.4","pypi:transformers@4.57.6"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-6rvg-6v2m-4j46","slug":"ghsa-6rvg-6v2m-4j46-e04ee614","dossier":false,"summary":"Transformers Regular Expression Denial of Service (ReDoS) vulnerability","aliases":["CVE-2024-12720","PYSEC-2026-1982"],"sourceIds":["GHSA-6rvg-6v2m-4j46","PYSEC-2026-1982"],"published":"2025-03-20T12:32:43Z","modified":"2026-07-07T17:56:13.229192922Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12720"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/deac971c469bcbb182c2e52da0b82fb3bf54cccf"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/4bed1214-7835-4252-a853-22bbad891f98"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6rvg-6v2m-4j46"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-9356-575x-2w9m","slug":"ghsa-9356-575x-2w9m-908a1f8c","dossier":false,"summary":"Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability","aliases":["CVE-2025-5197","PYSEC-2026-1983"],"sourceIds":["GHSA-9356-575x-2w9m","PYSEC-2026-1983"],"published":"2025-08-06T12:31:20Z","modified":"2026-07-07T17:57:12.881673492Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5197"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/701caef704e356dc2f9331cc3fd5df0eccb4720a"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/944b56000be5e9b61af8301aa340838770ad8a0b"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/3f8b3fd0-166b-46e7-b60f-60dd9d2678bf"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9356-575x-2w9m"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-fgcw-684q-jj6r","slug":"ghsa-fgcw-684q-jj6r-9fe55ba1","dossier":false,"summary":"huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path","aliases":["CVE-2026-5241","PYSEC-2026-2290"],"sourceIds":["GHSA-fgcw-684q-jj6r","PYSEC-2026-2290"],"published":"2026-06-03T14:16:46.337Z","modified":"2026-07-16T23:59:26.091024755Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5241"},{"type":"FIX","url":"https://github.com/huggingface/transformers/commit/676559d5022b74aaa0cee1cee0842b7f27c5320e"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34456"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:37275"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-5241"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484384"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2026-2290.yaml"},{"type":"EVIDENCE","url":"https://huntr.com/bounties/ceb3ce1a-4c45-497a-b25e-cb9a7685e619"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5241.json"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3","pypi:transformers@4.53.1","pypi:transformers@4.57.1","pypi:transformers@4.57.3","pypi:transformers@4.57.4","pypi:transformers@4.57.6"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-fpwr-67px-3qhx","slug":"ghsa-fpwr-67px-3qhx-94f30126","dossier":false,"summary":"Transformers Regular Expression Denial of Service (ReDoS) vulnerability","aliases":["CVE-2025-1194","PYSEC-2026-1984"],"sourceIds":["GHSA-fpwr-67px-3qhx","PYSEC-2026-1984"],"published":"2025-04-29T12:30:21Z","modified":"2026-07-07T17:57:12.290933710Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1194"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/92c5ca9dd70de3ade2af2eb835c96215cc50e815"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/86f58dcd-683f-4adc-a735-849f51e9abb2"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-fpwr-67px-3qhx"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-hxxf-235m-72v3","slug":"ghsa-hxxf-235m-72v3-21da19b0","dossier":false,"summary":"Deserialization of Untrusted Data in Hugging Face Transformers","aliases":["CVE-2024-11394","PYSEC-2024-229"],"sourceIds":["GHSA-hxxf-235m-72v3","PYSEC-2024-229"],"published":"2024-11-22T22:15:07Z","modified":"2026-06-10T17:02:30.328718397Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11394"},{"type":"WEB","url":"https://github.com/huggingface/transformers/issues/34840"},{"type":"WEB","url":"https://github.com/huggingface/transformers/pull/35296"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2024-229.yaml"},{"type":"WEB","url":"https://www.zerodayinitiative.com/advisories/ZDI-24-1515"},{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-24-1515/"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hxxf-235m-72v3"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-jjph-296x-mrcr","slug":"ghsa-jjph-296x-mrcr-0f661d67","dossier":false,"summary":"Transformers vulnerable to ReDoS attack through its get_imports() function","aliases":["CVE-2025-3264","PYSEC-2026-1985"],"sourceIds":["GHSA-jjph-296x-mrcr","PYSEC-2026-1985"],"published":"2025-07-07T12:30:22Z","modified":"2026-07-07T17:56:51.899728258Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3264"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/0720e206c6ba28887e4d60ef60a6a089f6c1cc76"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/126abe3461762e5fc180e7e614391d1b4ab051ca"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/3c6f7822-9992-476d-8cf0-b0b1623427df"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jjph-296x-mrcr"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-phhr-52qp-3mj4","slug":"ghsa-phhr-52qp-3mj4-6f5d82e3","dossier":false,"summary":"Transformers's Improper Input Validation vulnerability can be exploited through username injection","aliases":["CVE-2025-3777","PYSEC-2026-1986"],"sourceIds":["GHSA-phhr-52qp-3mj4","PYSEC-2026-1986"],"published":"2025-07-07T12:30:22Z","modified":"2026-07-07T17:56:47.225461188Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3777"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/4dda5f71b35fb70cf602187eef84bb17a50b9082"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://github.com/huggingface/transformers/blame/a7d2bbaaa8aac64f7c1ee8c1421cfe84b38359a4/src/transformers/image_utils.py"},{"type":"WEB","url":"https://huntr.com/bounties/ccba0730-9248-4853-b7ff-5c20e6364f09"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-phhr-52qp-3mj4"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-q2wp-rjmx-x6x9","slug":"ghsa-q2wp-rjmx-x6x9-43135d3d","dossier":false,"summary":"Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking","aliases":["CVE-2025-3263","PYSEC-2026-1987"],"sourceIds":["GHSA-q2wp-rjmx-x6x9","PYSEC-2026-1987"],"published":"2025-07-07T12:30:22Z","modified":"2026-07-07T17:56:57.889099913Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3263"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/0720e206c6ba28887e4d60ef60a6a089f6c1cc76"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/126abe3461762e5fc180e7e614391d1b4ab051ca"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/c7a69150-54f8-4e81-8094-791e7a2a0f29"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-q2wp-rjmx-x6x9"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-qq3j-4f4f-9583","slug":"ghsa-qq3j-4f4f-9583-cd76c72c","dossier":false,"summary":"Hugging Face Transformers Regular Expression Denial of Service","aliases":["CVE-2025-2099","PYSEC-2025-40"],"sourceIds":["GHSA-qq3j-4f4f-9583","PYSEC-2025-40"],"published":"2025-05-19T12:15:19Z","modified":"2026-06-10T17:02:48.111891265Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2099"},{"type":"WEB","url":"https://github.com/huggingface/transformers/pull/36648"},{"type":"FIX","url":"https://github.com/huggingface/transformers/commit/8cb522b4190bd556ce51be04942720650b1a3e57"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2025-40.yaml"},{"type":"WEB","url":"https://huntr.com/bounties/97b780f3-ffca-424f-ad5d-0e1c57a5bde4"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-qq3j-4f4f-9583"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-qxrp-vhvm-j765","slug":"ghsa-qxrp-vhvm-j765-63c6e9a2","dossier":false,"summary":"Deserialization of Untrusted Data in Hugging Face Transformers","aliases":["CVE-2024-11392","PYSEC-2024-227"],"sourceIds":["GHSA-qxrp-vhvm-j765","PYSEC-2024-227"],"published":"2024-11-22T22:15:06Z","modified":"2026-06-10T17:02:35.857656186Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11392"},{"type":"WEB","url":"https://github.com/huggingface/transformers/issues/34840"},{"type":"WEB","url":"https://github.com/huggingface/transformers/pull/35296"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2024-227.yaml"},{"type":"WEB","url":"https://www.zerodayinitiative.com/advisories/ZDI-24-1513"},{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-24-1513/"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-qxrp-vhvm-j765"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-rcv9-qm8p-9p6j","slug":"ghsa-rcv9-qm8p-9p6j-edc1db04","dossier":false,"summary":"Hugging Face Transformers library has Regular Expression Denial of Service","aliases":["CVE-2025-6051","PYSEC-2026-1988"],"sourceIds":["GHSA-rcv9-qm8p-9p6j","PYSEC-2026-1988"],"published":"2025-09-14T18:30:26Z","modified":"2026-07-07T17:56:51.178415128Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6051"},{"type":"WEB","url":"https://github.com/huggingface/transformers/pull/38844"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/54a02160eb030da9be18231c77791f2eb3a52216"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/ba8eaba9865618253f997784aa565b96206426f0"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/af929523-7b59-418a-bf55-301830b2ac9d"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-rcv9-qm8p-9p6j"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-wrfc-pvp9-mr9g","slug":"ghsa-wrfc-pvp9-mr9g-c6b03ddf","dossier":false,"summary":"Deserialization of Untrusted Data in Hugging Face Transformers","aliases":["CVE-2024-11393","PYSEC-2024-228"],"sourceIds":["GHSA-wrfc-pvp9-mr9g","PYSEC-2024-228"],"published":"2024-11-22T22:15:07Z","modified":"2026-06-10T17:00:13.252500033Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11393"},{"type":"WEB","url":"https://github.com/huggingface/transformers/issues/34840"},{"type":"WEB","url":"https://github.com/huggingface/transformers/pull/35296"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2024-228.yaml"},{"type":"WEB","url":"https://www.zerodayinitiative.com/advisories/ZDI-24-1514"},{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-24-1514/"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wrfc-pvp9-mr9g"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"PYSEC-2025-211","slug":"pysec-2025-211-d8bd15de","dossier":false,"summary":null,"aliases":["CVE-2025-14920"],"sourceIds":["PYSEC-2025-211"],"published":"2025-12-23T21:15:47.183Z","modified":"2026-05-21T15:00:32.080516132Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1150/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3","pypi:transformers@4.53.1"],"packageCount":1,"repositoryCount":3},{"id":"PYSEC-2025-212","slug":"pysec-2025-212-a011b97d","dossier":false,"summary":null,"aliases":["CVE-2025-14921"],"sourceIds":["PYSEC-2025-212"],"published":"2025-12-23T21:15:47.340Z","modified":"2026-05-21T15:00:32.052313357Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1149/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3","pypi:transformers@4.53.1"],"packageCount":1,"repositoryCount":3},{"id":"PYSEC-2025-213","slug":"pysec-2025-213-9043dc9b","dossier":false,"summary":null,"aliases":["CVE-2025-14924"],"sourceIds":["PYSEC-2025-213"],"published":"2025-12-23T21:15:47.600Z","modified":"2026-05-21T15:00:32.048516839Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1141/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3","pypi:transformers@4.53.1"],"packageCount":1,"repositoryCount":3},{"id":"PYSEC-2025-214","slug":"pysec-2025-214-eb241255","dossier":false,"summary":null,"aliases":["CVE-2025-14926"],"sourceIds":["PYSEC-2025-214"],"published":"2025-12-23T21:15:47.857Z","modified":"2026-05-21T15:00:32.929011749Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1147/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3","pypi:transformers@4.53.1"],"packageCount":1,"repositoryCount":3},{"id":"PYSEC-2025-215","slug":"pysec-2025-215-6064f491","dossier":false,"summary":null,"aliases":["CVE-2025-14927"],"sourceIds":["PYSEC-2025-215"],"published":"2025-12-23T21:15:47.987Z","modified":"2026-05-21T15:00:32.888290877Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1148/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3","pypi:transformers@4.53.1"],"packageCount":1,"repositoryCount":3},{"id":"PYSEC-2025-216","slug":"pysec-2025-216-5708ed01","dossier":false,"summary":null,"aliases":["CVE-2025-14928"],"sourceIds":["PYSEC-2025-216"],"published":"2025-12-23T21:15:48.110Z","modified":"2026-05-21T15:00:32.939311939Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1146/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3","pypi:transformers@4.53.1"],"packageCount":1,"repositoryCount":3},{"id":"PYSEC-2025-217","slug":"pysec-2025-217-2c1ad388","dossier":false,"summary":null,"aliases":["CVE-2025-14929"],"sourceIds":["PYSEC-2025-217"],"published":"2025-12-23T21:15:48.240Z","modified":"2026-05-21T15:00:24.271970226Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1144/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3","pypi:transformers@4.53.1","pypi:transformers@4.57.1","pypi:transformers@4.57.3","pypi:transformers@4.57.4","pypi:transformers@4.57.6"],"packageCount":1,"repositoryCount":8},{"id":"PYSEC-2025-218","slug":"pysec-2025-218-39811fc3","dossier":false,"summary":null,"aliases":["CVE-2025-14930"],"sourceIds":["PYSEC-2025-218"],"published":"2025-12-23T21:15:48.367Z","modified":"2026-05-21T15:00:33.791364554Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1145/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3","pypi:transformers@4.53.1","pypi:transformers@4.57.1"],"packageCount":1,"repositoryCount":5}]}}