Skip to content
OpenAdvisories

Package · PyPI

smolagents

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-4963

    huggingface smolagents Incomplete Fix CVE-2025-9959 local_python_executor.py evaluate_with code injection

    A weakness has been identified in huggingface smolagents 1.25.0.dev0. This affects the function evaluate_augassign/evaluate_call/evaluate_with of the file src/smolagents/local_python_executor.py of the component Incomplete Fix CVE-2025-9959. This manipulation…

    Hugging Face smolagents smolagents PyPI
  • Medium 6.3
    CVE-2026-2654

    huggingface smolagents LocalPythonExecutor requests.post server-side request forgery

    A weakness has been identified in huggingface smolagents 1.24.0. Impacted is the function requests.get/requests.post of the component LocalPythonExecutor. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack re…

    Hugging Face smolagents smolagents PyPI
  • Medium 5.4
    CVE-2025-11844 Public exploit

    XPath Injection in Hugging Face Smolagents search_item_ctrl_f Function

    Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py. The function constructs an XPath query by directly concatenating user-supplied input into the …

    Hugging Face huggingface/smolagents smolagents PyPI