Read the docs

huggingface

Records59All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical6CVSS 9.0–10.0
CVSS high32CVSS 7.0–8.9

Exploited now

huggingface records in CISA KEV

No huggingface vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Transformers 30 records HIGH Smolagents 4 records HIGH Diffusers 3 records HIGH Datasets 1 record MEDIUM Lerobot 1 record HIGH

Records

4 records in Smolagents · all components

TI-2025-04589 CVE-2025-5120 · GHSA-6v92-r5mx-h5fx

Sandbox Escape Vulnerability in huggingface/smolagents

Priority HIGH 76

A sandbox escape vulnerability was identified in huggingface/smolagents version 1.14.0, allowing attackers to bypass the restricted execution environment and achieve remote code execution (RCE).

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.31237 Published 2025-07-27 Fixed in 1.17.0 CWE-94
TI-2025-10859 CVE-2025-11844 · GHSA-8mf9-rmgw-33qc

XPath Injection in Hugging Face Smolagents search_item_ctrl_f Function

Priority MEDIUM 58

Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py.

CVSS 3.0MEDIUM 5.4 Network No auth User interaction EPSS 0.0028 Published 2025-10-22 Fixed in 1.22.0 CWE-643
Open these records in search →