CVE-2025-9959
published 2025-09-03CVE-2025-9959: Incomplete validation of dunder attributes allows an attacker to escape from the Local Python execution environment sandbox, enforced by smolagents. The attack…
PriorityP342high7.6CVSS 3.1
AVNACLPRNUIRSUCLIHAL
EPSS
0.29%
20.7th percentile
Incomplete validation of dunder attributes allows an attacker to escape from the Local Python execution environment sandbox, enforced by smolagents. The attack requires a Prompt Injection in order to trick the agent to create malicious code.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| huggingface | smolagents | — | — |
| huggingface | smolagents | — | — |
| huggingface | smolagents | 0 – 1.25.0.dev0 | — |
CVSS provenance
nvdv3.17.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L
ghsa7.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
huggingface smolagents 1.25.0.dev0 Incomplete Fix CVE-2025-9959 local_python_executor.py evaluate_augassign/evaluate_call/evaluate_with code injection
vuldb·2026-05-06·CVSS 7.6
CVE-2026-4963 [HIGH] huggingface smolagents 1.25.0.dev0 Incomplete Fix CVE-2025-9959 local_python_executor.py evaluate_augassign/evaluate_call/evaluate_with code injection
A vulnerability has been found in huggingface smolagents 1.25.0.dev0 and classified as critical. This affects the function evaluate_augassign/evaluate_call/evaluate_with of the file src/smolagents/local_python_executor.py of the component Incomplete Fix CVE-2025-9959. This manipulation causes code injection.
The identification of this vulnerability is CVE-2026-4963. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.
The vendor was contacted early about this disclosure but did not respond in any way.
GHSA
Hugging Face Smolagents has an Injection issue
ghsa·2026-03-27·CVSS 7.6
CVE-2026-4963 [HIGH] CWE-74 Hugging Face Smolagents has an Injection issue
Hugging Face Smolagents has an Injection issue
A weakness has been identified in huggingface smolagents 1.25.0.dev0. This affects the function evaluate_augassign/evaluate_call/evaluate_with of the file src/smolagents/local_python_executor.py of the component Incomplete Fix CVE-2025-9959. This manipulation causes code injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
GHSA
GHSA-54fq-v6x8-244g: A weakness has been identified in huggingface smolagents 1
ghsa_unreviewed·2026-03-27·CVSS 7.6
CVE-2026-4963 [HIGH] CWE-74 GHSA-54fq-v6x8-244g: A weakness has been identified in huggingface smolagents 1
A weakness has been identified in huggingface smolagents 1.25.0.dev0. This affects the function evaluate_augassign/evaluate_call/evaluate_with of the file src/smolagents/local_python_executor.py of the component Incomplete Fix CVE-2025-9959. This manipulation causes code injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. If you want to get best quality of vulnerability data, you may have to visit VulDB.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-09-03
Published