-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| transformers | pip | <= 4.51.3 | 4.52.1 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the token2json method of the DonutProcessor class within the Hugging Face Transformers library. The root cause is the use of an inefficient regular expression, r"<s_(.*?)>", which is susceptible to catastrophic backtracking, a common cause of ReDoS vulnerabilities. The provided patch, commit ebbe9b12dd75b69f92100d684c47f923ee262a93, directly addresses this issue by removing the vulnerable re.search call and replacing it with a series of non-regex string manipulations to find the start and end tags. This confirms that the token2json function is the precise location of the vulnerability. Any runtime profile during an exploit of this CVE would show this function consuming significant CPU resources.
A Semantic Attack on Google Gemini - Read the Latest Research