A weakness has been identified in huggingface smolagents 1.25.0.dev0. This affects the function evaluate_augassign/evaluate_call/evaluate_with of the file src/smolagents/local_python_executor.py of the component Incomplete Fix CVE-2025-9959. This manipulation causes code injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 2.1 · huggingfaceNVD modified 2026-10-26 21:10
Affected (CPE criteria) 1
cpe:2.3:a:huggingface:smolagents:1.25.0:dev0:*:*:*:*:*:*
References 7
- https://gist.github.com/YLChen-007/35b7d46e892266a0ed6dbe57802858be Exploit, Third Party Advisory
- https://gist.github.com/YLChen-007/7146f45960f79bc1e2976fed526e0a9b Exploit, Third Party Advisory
- https://vuldb.com/?ctiid.353840 Permissions Required, VDB Entry
- https://vuldb.com/?id.353840 Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.777623 Exploit, Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.777643 Exploit, Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.777644 Exploit, Third Party Advisory, VDB Entry