Vulnerabilities for smolagents

First version without a known vulnerability: 1.25.0

Details

• GHSA-54fq-v6x8-244g2026-03-27

  Hugging Face Smolagents has an Injection issue

• GHSA-jxgv-6j54-wwc72026-02-18

  Hugging Face Smolagents has a Server-Side Request Forgery issue

• GHSA-q9r5-6hrr-9ph72025-12-23

  Hugging Face smolagents: Unsafe deserialization in Remote Python Executor leads to RCE

• GHSA-8mf9-rmgw-33qc2025-10-22

  Hugging Face Smolagents XPath injection vulnerability in the search_item_ctrl_f function

  Fixed in: 1.22.0

• GHSA-6v92-r5mx-h5fx2025-07-27

  smolagents has Sandbox Escape Vulnerability in the local_python_executor.py Module

  Fixed in: 1.17.0