MEDIUM5.4PyPI
PYSEC-2026-1930· CVE-2025-11844, GHSA-8mf9-rmgw-33qcHugging Face Smolagents XPath injection vulnerability in the search_item_ctrl_f function
Modified: 7/7/2026
package
PyPI/smolagents
pkg:pypi/smolagents
MEDIUM6.3PyPI
PYSEC-2026-3066· CVE-2026-4963, GHSA-54fq-v6x8-244gHugging Face Smolagents has an Injection issue
Modified: 7/13/2026
MEDIUM6.3PyPI
PYSEC-2026-3067· CVE-2026-2654, GHSA-jxgv-6j54-wwc7Hugging Face Smolagents has a Server-Side Request Forgery issue
Modified: 7/13/2026
CRITICAL9.9PyPI
PYSEC-2026-542· CVE-2025-5120, GHSA-6v92-r5mx-h5fxsmolagents has Sandbox Escape Vulnerability in the local_python_executor.py Module
Modified: 7/1/2026
CRITICAL10.0PyPI
PYSEC-2026-543· CVE-2025-14931, GHSA-q9r5-6hrr-9ph7Hugging Face smolagents: Unsafe deserialization in Remote Python Executor leads to RCE
Modified: 7/1/2026
MEDIUM6.3PyPI
GHSA-54fq-v6x8-244g· CVE-2026-4963, PYSEC-2026-3066Hugging Face Smolagents has an Injection issue
Modified: 7/13/2026
CRITICAL9.9PyPI
GHSA-6v92-r5mx-h5fx· CVE-2025-5120, PYSEC-2026-542smolagents has Sandbox Escape Vulnerability in the local_python_executor.py Module
Modified: 6/29/2026
MEDIUM5.4PyPI
GHSA-8mf9-rmgw-33qc· CVE-2025-11844, PYSEC-2026-1930Hugging Face Smolagents XPath injection vulnerability in the search_item_ctrl_f function
Modified: 7/7/2026
MEDIUM6.3PyPI
GHSA-jxgv-6j54-wwc7· CVE-2026-2654, PYSEC-2026-3067Hugging Face Smolagents has a Server-Side Request Forgery issue
Modified: 7/13/2026
CRITICAL10.0PyPI
GHSA-q9r5-6hrr-9ph7· CVE-2025-14931, PYSEC-2026-543Hugging Face smolagents: Unsafe deserialization in Remote Python Executor leads to RCE
Modified: 6/29/2026