CVE-2025-11844 XPath Injection in Hugging Face Smolagents search_item_ctrl_f Function

What is CVE-2025-11844?

CVE-2025-11844 is a medium-severity vulnerability in huggingface/smolagents, published on 22 Oct 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py. The function constructs an XPath query by directly concatenating user-supplied input into the XPath expression without proper sanitization or escaping. This allows an attacker to inject malicious XPath syntax that can alter the intended query logic. The vulnerability enables attackers to bypass search filters, access unintended DOM elements, and disrupt web automation workflows. This can lead to information disclosure, manipulation of AI agent interactions, and compromise the reliability of automated web tasks. The issue is fixed in version 1.22.0.

Weakness: CWE-643

Which versions are affected by CVE-2025-11844?

3 open source packages ship an affected version, including smolagents. It affects 1 product.

Products include Huggingface Smolagents.

How do I fix CVE-2025-11844?

Upgrade smolagents to 1.22.0 or later.

Is CVE-2025-11844 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-11844 exists.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in huggingface/smolagents

• CVE-2025-5120 Sandbox Escape Vulnerability in huggingface/smolagents High 7.6
• CVE-2026-4963 huggingface smolagents Incomplete Fix CVE-2025-9959 local_python_executor.py evaluate_with code injection Medium 5.3
• CVE-2026-2654 huggingface smolagents LocalPythonExecutor requests.post server-side request forgery Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8mf9-rmgw-33qc, PYSEC-2026-1930.