Skip to content
OpenAdvisories
Medium · 5.4 Public exploit CVE-2025-11844 EUVD-2025-35361GHSA-8mf9-rmgw-33qcPYSEC-2026-1930

XPath Injection in Hugging Face Smolagents search_item_ctrl_f Function

Published Oct 22, 2025 · Updated Oct 22, 2025 · Assigned by @huntr_ai

Vendor: Hugging Face Product: huggingface/smolagents Package: smolagents Ecosystem: PyPI

Description

Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py. The function constructs an XPath query by directly concatenating user-supplied input into the XPath expression without proper sanitization or escaping. This allows an attacker to inject malicious XPath syntax that can alter the intended query logic. The vulnerability enables attackers to bypass search filters, access unintended DOM elements, and disrupt web automation workflows. This can lead to information disclosure, manipulation of AI agent interactions, and compromise the reliability of automated web tasks. The issue is fixed in version 1.22.0.

Affected products

VendorProductAffectedFixed
huggingface huggingface/smolagents unspecified – < 1.22.0 1.22.0

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI smolagents < 1.22.0 1.22.0 GHSA-8mf9-rmgw-33qc

References