Skip to content
OpenAdvisories

Vendor

huggingface

40 known vulnerabilities.

Products

huggingface/transformers 20 diffusers 4 datasets 3 huggingface/smolagents 2 huggingface/text-generation-inference 2 smolagents 2 transformers 1 peft 1 tokenizers 1 text-generation-inference 1 accelerate 1 LeRobot 1 finetrainers 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.4
    CVE-2025-11844 Public exploit

    XPath Injection in Hugging Face Smolagents search_item_ctrl_f Function

    Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py. The function constructs an XPath query by directly concatenating user-supplied input into the …

    huggingface huggingface/smolagents smolagents PyPI