GitHub Advisoryadvisory · PyPI

GHSA-54fq-v6x8-244g Hugging Face Smolagents has an Injection issue

LOW Published 2026-03-27 Modified 2026-05-06 Official page ↗
Aliases
CVE-2026-4963
Ecosystem
PyPI
Packages
smolagents
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Weaknesses
CWE-74
Reviewed
2026-05-06

Affected packages

• PyPI smolagents: <= 1.25.0.dev0 (no fix yet)

Description

A weakness has been identified in huggingface smolagents 1.25.0.dev0. This affects the function evaluate_augassign/evaluate_call/evaluate_with of the file src/smolagents/local_python_executor.py of the component Incomplete Fix CVE-2025-9959. This manipulation causes code injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Related

Alias · CVE (1)

  • CVE-2026-4963 A weakness has been identified in huggingface smolagents 1.25.0.dev0. vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References