GHSA-qq3j-4f4f-9583 Hugging Face Transformers Regular Expression Denial of Service

• PyPI transformers: < 4.50.0 → fixed in 4.50.0

A Regular Expression Denial of Service (ReDoS) exists in the `preprocess_string()` function of the `transformers.testing_utils` module. In versions before 4.50.0, the regex used to process code blocks in docstrings contains nested quantifiers that can trigger catastrophic backtracking when given inputs with many newline characters. An attacker who can supply such input to `preprocess_string()` (or code paths that call it) can force excessive CPU usage and degrade availability. Fix: released in 4.50.0, which rewrites the regex to avoid the inefficient pattern. ([GitHub][1]) • Affected: `< 4.50.0` • Patched: `4.50.0`