Smolagents
Vendor:
First CVE: Jul 27, 2025 · Active for under a year
4
Total CVEs
More Total CVEs than 72% of tracked products
2.0
Avg CVEs / Year
Higher CVE frequency than 60% of tracked products
8.8
Avg CVSS
Higher Avg CVSS than 79% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Smolagents over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jul 27, 2025
11 months ago
Most Recent CVE
Mar 27, 2026
122 days ago
CVE Severity & Scoring
Smolagents4 CVEs
25%
75%
All CVEs352,785 CVEs
45%
40%
11%
MediumCritical
Attack Vector
Local0 (0.0%)
Network4 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low4 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None3 (75.0%)
Unknown0 (0.0%)
Required1 (25.0%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None4 (100.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-5120CRITICAL A sandbox escape vulnerability was identified in huggingface/smolagents version 1.14.0, allowing attackers to bypass the restricted execution environment and achieve remote code ex | Jul 27, 2025 | 10.0 | 44 | NO | NO |
CVE-2026-2654CRITICAL A weakness has been identified in huggingface smolagents 1.24.0. Impacted is the function requests.get/requests.post of the component LocalPythonExecutor. Executing a manipulation | Feb 18, 2026 | 9.8 | 34 | NO | NO |
CVE-2026-4963CRITICAL A weakness has been identified in huggingface smolagents 1.25.0.dev0. This affects the function evaluate_augassign/evaluate_call/evaluate_with of the file src/smolagents/local_pyth | Mar 27, 2026 | 10.0 | 31 | NO | NO |
CVE-2025-11844MEDIUM Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py. The function co | Oct 22, 2025 | 5.4 | 20 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (4 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (4 CVEs).
Media Mentions
Signals from CVEs in this product scope (4 CVEs).
Top CNAs Publishing CVEs For Smolagents
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 1.25.0 | 1 | 10.0 | 0.6% | 0 | 0 |
| 1.14.0 | 1 | 10.0 | 18.6% | 0 | 0 |