Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: huggingface Component: Smolagents Clear all filters
TI-2025-10859 CVE-2025-11844 · GHSA-8mf9-rmgw-33qc

XPath Injection in Hugging Face Smolagents search_item_ctrl_f Function

Priority MEDIUM 58

Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py.

CVSS 3.0MEDIUM 5.4 Network No auth User interaction EPSS 0.0028 Published 2025-10-22 Fixed in 1.22.0 CWE-643
TI-2025-04589 CVE-2025-5120 · GHSA-6v92-r5mx-h5fx

Sandbox Escape Vulnerability in huggingface/smolagents

Priority HIGH 76

A sandbox escape vulnerability was identified in huggingface/smolagents version 1.14.0, allowing attackers to bypass the restricted execution environment and achieve remote code execution (RCE).

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.31237 Published 2025-07-27 Fixed in 1.17.0 CWE-94