CVE-2025-5120 Sandbox Escape Vulnerability in huggingface/smolagents
Attackers can bypass sandbox restrictions in huggingface/smolagents to execute arbitrary code on the host system, leading to remote code execution and data leakage.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-5120?
CVE-2025-5120 is a high-severity code injection vulnerability in huggingface/smolagents, published on 27 Jul 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A sandbox escape vulnerability was identified in huggingface/smolagents version 1.14.0, allowing attackers to bypass the restricted execution environment and achieve remote code execution (RCE). The vulnerability stems from the local_python_executor.py module, which inadequately restricts Python code execution despite employing static and dynamic checks. Attackers can exploit whitelisted modules and functions to execute arbitrary code, compromising the host system. This flaw undermines the core security boundary intended to isolate untrusted code, posing risks such as unauthorized code execution, data leakage, and potential integration-level compromise. The issue is resolved in version 1.17.0.
Weakness: CWE-94
Which versions are affected by CVE-2025-5120?
3 open source packages ship an affected version, including smolagents. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
smolagents PyPI | All versions | 1.17.0 |
smolagents PyPI | All versions | 1.17.0 |
smolagents PyPI | All versions | 1.17.0 |
Products include Huggingface Smolagents.
How do I fix CVE-2025-5120?
Upgrade smolagents to 1.17.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-5120 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-5120 exists.
Other vulnerabilities in huggingface/smolagents
- CVE-2025-11844 XPath Injection in Hugging Face Smolagents search_item_ctrl_f Function
- CVE-2026-4963 huggingface smolagents Incomplete Fix CVE-2025-9959 local_python_executor.py evaluate_with code injection
- CVE-2026-2654 huggingface smolagents LocalPythonExecutor requests.post server-side request forgery
Sources
Also known as GHSA-6v92-r5mx-h5fx, PYSEC-2026-542.