Read the docs
TI-2025-04589 Aliases CVE-2025-5120GHSA-6v92-r5mx-h5fx

Sandbox Escape Vulnerability in huggingface/smolagents

Priority HIGH 76CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

A sandbox escape vulnerability was identified in huggingface/smolagents version 1.14.0, allowing attackers to bypass the restricted execution environment and achieve remote code execution (RCE). The vulnerability stems from the local_python_executor.py module, which inadequately restricts Python code execution despite employing static and dynamic checks. Attackers can exploit whitelisted modules and functions to execute arbitrary code, compromising the host system. This flaw undermines the core security boundary intended to isolate untrusted code, posing risks such as unauthorized code execution, data leakage, and potential integration-level compromise. The issue is resolved in version 1.17.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.31237 98th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed huggingface/smolagents (huggingface): 1.17.0smolagents (PyPI): 1.17.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
huggingfacehuggingface/smolagentsbefore 1.17.01.17.0Patch availableCNA
—smolagents (PyPI)before 1.17.01.17.0Patch availableGHSA-6v92-r5mx-h5fx
  • huggingface/smolagents Vendorhuggingface Affected before 1.17.0 Fixed in 1.17.0 Patch available CNA
  • smolagents (PyPI) Vendor— Affected before 1.17.0 Fixed in 1.17.0 Patch available GHSA-6v92-r5mx-h5fx

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:huggingface:smolagents:1.14.0:*:*:*:*:*:*:*1.14.0Vulnerablehuggingface
  • cpe:2.3:a:huggingface:smolagents:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·huggingface

Remediation

  • Fix · CNA huggingface/smolagents (huggingface) Fixed in 1.17.0
  • Fix · GHSA-6v92-r5mx-h5fx smolagents (PyPI) Fixed in 1.17.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-5120
  2. 2026-10-03 Alias added: GHSA-6v92-r5mx-h5fx

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2025-10859 XPath Injection in Hugging Face Smolagents search_item_ctrl_f Function CVSS 3.0MEDIUM 5.4
  • TI-2026-04324 huggingface smolagents Incomplete Fix CVE-2025-9959 local_python_executor.py evaluate_with code injection CVSS 4.0MEDIUM 5.3
  • TI-2026-02266 huggingface smolagents LocalPythonExecutor requests.post server-side request forgery CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences