{"data":{"id":"8482b21e-7b1b-45fa-b6e4-4d207d68db36","title":"CVE-2026-4963: A weakness has been identified in huggingface smolagents 1.25.0.dev0. This affects the function…","summary":"A weakness in huggingface smolagents 1.25.0.dev0, in the functions evaluate_augassign, evaluate_call and evaluate_with in src/smolagents/local_python_executor.py, allows code injection. It is an incomplete fix for CVE-2025-9959 and can be triggered remotely. A public exploit exists, and the vendor did not respond to early disclosure.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-4963","publishedAt":"2026-03-27T17:16:31.537Z","cveId":"CVE-2026-4963","cweIds":["CWE-74","CWE-94"],"cvssScore":"6.3","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["smolagents@<= 1.25.0.dev0"],"affectedPackageNames":["smolagents"],"affectedPackageRefs":["pypi:smolagents"],"affectedVendors":["HuggingFace"],"affectedVendorsRaw":["smolagents"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"huggingface smolagents code injection in local Python executor evaluation","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"required","exploitMaturity":"unknown","epssScore":0.00586,"epssCheckedAt":"2026-11-10T12:15:59.727Z","kevDateAdded":null,"advisoryAliases":["GHSA-54fq-v6x8-244g"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:50:10.116Z","patchAvailable":null,"disclosureDate":"2026-03-27T17:16:31.537Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-242"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}