{"data":{"ecosystem":"pypi","name":"smolagents","url":"https://aisecwatch.com/packages/pypi/smolagents","latestVersion":"1.26.0","firstReleaseAt":"2024-12-27T15:56:26.044Z","repository":null,"llm":{"exposure":"direct","depth":0,"integratedAt":"2024-12-27T15:56:26.044Z","integratedVersion":"0.1.0","sdks":["smolagents"],"path":[]},"authority":{"profile":["browser","execution","http","mcp_tools"],"fromDependencies":["pypi:docker","pypi:e2b-code-interpreter","pypi:mcp","pypi:requests","pypi:selenium"]},"dependencies":[{"ecosystem":"pypi","name":"accelerate","versionSpec":null,"scope":"extra:transformers"},{"ecosystem":"pypi","name":"arize-phoenix","versionSpec":null,"scope":"extra:telemetry"},{"ecosystem":"pypi","name":"blaxel","versionSpec":">=0.2.19","scope":"extra:blaxel"},{"ecosystem":"pypi","name":"ddgs","versionSpec":">=9.0.0","scope":"extra:toolkit"},{"ecosystem":"pypi","name":"gradio","versionSpec":">=5.14.0","scope":"extra:gradio"},{"ecosystem":"pypi","name":"huggingface-hub","versionSpec":">=0.31.2","scope":"runtime"},{"ecosystem":"pypi","name":"litellm","versionSpec":">=1.60.2","scope":"extra:litellm"},{"ecosystem":"pypi","name":"mcp","versionSpec":null,"scope":"extra:mcp"},{"ecosystem":"pypi","name":"mcpadapt","versionSpec":">=0.1.13","scope":"extra:mcp"},{"ecosystem":"pypi","name":"mlx-lm","versionSpec":null,"scope":"extra:mlx-lm"},{"ecosystem":"pypi","name":"openai","versionSpec":">=1.58.1","scope":"extra:openai"},{"ecosystem":"pypi","name":"openinference-instrumentation-smolagents","versionSpec":">=0.1.15","scope":"extra:telemetry"},{"ecosystem":"pypi","name":"transformers","versionSpec":">=4.0.0","scope":"extra:transformers"},{"ecosystem":"pypi","name":"vllm","versionSpec":">=0.10.2","scope":"extra:vllm"},{"ecosystem":"pypi","name":"boto3","versionSpec":">=1.36.18","scope":"extra:bedrock"},{"ecosystem":"pypi","name":"docker","versionSpec":">=7.1.0","scope":"extra:docker"},{"ecosystem":"pypi","name":"e2b-code-interpreter","versionSpec":">=1.0.3","scope":"extra:e2b"},{"ecosystem":"pypi","name":"helium","versionSpec":null,"scope":"extra:vision"},{"ecosystem":"pypi","name":"ipython","versionSpec":">=8.31.0","scope":"extra:test"},{"ecosystem":"pypi","name":"jinja2","versionSpec":">=3.1.4","scope":"runtime"},{"ecosystem":"pypi","name":"markdownify","versionSpec":">=0.14.1","scope":"extra:toolkit"},{"ecosystem":"pypi","name":"mlx","versionSpec":null,"scope":"extra:test"},{"ecosystem":"pypi","name":"modal","versionSpec":">=1.1.3","scope":"extra:modal"},{"ecosystem":"pypi","name":"numpy","versionSpec":">=1.21.2","scope":"extra:torch"},{"ecosystem":"pypi","name":"opentelemetry-exporter-otlp","versionSpec":null,"scope":"extra:telemetry"},{"ecosystem":"pypi","name":"opentelemetry-sdk","versionSpec":null,"scope":"extra:telemetry"},{"ecosystem":"pypi","name":"pandas","versionSpec":">=2.2.3","scope":"extra:test"},{"ecosystem":"pypi","name":"pillow","versionSpec":">=10.0.1","scope":"runtime"},{"ecosystem":"pypi","name":"pytest","versionSpec":">=8.1.0","scope":"extra:test"},{"ecosystem":"pypi","name":"pytest-datadir","versionSpec":null,"scope":"extra:test"},{"ecosystem":"pypi","name":"pytest-timeout","versionSpec":null,"scope":"extra:test"},{"ecosystem":"pypi","name":"python-dotenv","versionSpec":null,"scope":"runtime"},{"ecosystem":"pypi","name":"rank-bm25","versionSpec":null,"scope":"extra:test"},{"ecosystem":"pypi","name":"requests","versionSpec":">=2.32.3","scope":"runtime"},{"ecosystem":"pypi","name":"rich","versionSpec":">=13.9.4","scope":"runtime"},{"ecosystem":"pypi","name":"ruff","versionSpec":">=0.9.0","scope":"extra:quality"},{"ecosystem":"pypi","name":"selenium","versionSpec":null,"scope":"extra:vision"},{"ecosystem":"pypi","name":"soundfile","versionSpec":null,"scope":"extra:audio"},{"ecosystem":"pypi","name":"sqlalchemy","versionSpec":null,"scope":"extra:dev"},{"ecosystem":"pypi","name":"torch","versionSpec":null,"scope":"extra:torch"},{"ecosystem":"pypi","name":"torchvision","versionSpec":null,"scope":"extra:torch"},{"ecosystem":"pypi","name":"websocket-client","versionSpec":null,"scope":"extra:blaxel"},{"ecosystem":"pypi","name":"wikipedia-api","versionSpec":">=0.8.1","scope":"extra:test"}],"advisories":[{"id":"8482b21e-7b1b-45fa-b6e4-4d207d68db36","url":"https://aisecwatch.com/issues/8482b21e-7b1b-45fa-b6e4-4d207d68db36","cveId":"CVE-2026-4963","title":"CVE-2026-4963: A weakness has been identified in huggingface smolagents 1.25.0.dev0. This affects the function…","headline":"huggingface smolagents code injection in local Python executor evaluation","severity":"medium","publishedAt":"2026-03-27T17:16:31.537Z","affected":["smolagents@<= 1.25.0.dev0"],"epssScore":0.00732},{"id":"77ffca6b-094a-4f49-bf36-58325717a2df","url":"https://aisecwatch.com/issues/77ffca6b-094a-4f49-bf36-58325717a2df","cveId":"CVE-2026-2654","title":"CVE-2026-2654: A weakness has been identified in huggingface smolagents 1.24.0. Impacted is the function requests.get/requests.post of…","headline":"huggingface smolagents LocalPythonExecutor server-side request forgery","severity":"medium","publishedAt":"2026-02-18T14:16:07.277Z","affected":["smolagents@<= 1.24.0"],"epssScore":0.00566},{"id":"65fb95b4-4e04-4918-9a93-ce03f263be50","url":"https://aisecwatch.com/issues/65fb95b4-4e04-4918-9a93-ce03f263be50","cveId":"CVE-2025-14931","title":"GHSA-q9r5-6hrr-9ph7: Hugging Face smolagents: Unsafe deserialization in Remote Python Executor leads to RCE","headline":null,"severity":"critical","publishedAt":"2025-12-23T21:30:29.000Z","affected":["smolagents@<= 1.23.0"],"epssScore":0.01087},{"id":"827da033-95b5-41ef-bf22-cb66cea3c26f","url":"https://aisecwatch.com/issues/827da033-95b5-41ef-bf22-cb66cea3c26f","cveId":"CVE-2025-11844","title":"CVE-2025-11844: Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function…","headline":"Hugging Face Smolagents XPath injection in search_item_ctrl_f function","severity":"medium","publishedAt":"2025-10-22T14:15:49.457Z","affected":["smolagents@< 1.22.0 (fixed: 1.22.0)"],"epssScore":0.00283},{"id":"663b1a07-6fc4-4abd-9c19-8446d3b8ff18","url":"https://aisecwatch.com/issues/663b1a07-6fc4-4abd-9c19-8446d3b8ff18","cveId":"CVE-2025-5120","title":"CVE-2025-5120: A sandbox escape vulnerability was identified in huggingface/smolagents version 1.14.0, allowing attackers to bypass…","headline":"huggingface/smolagents sandbox escape allowing remote code execution","severity":"critical","publishedAt":"2025-07-27T12:15:25.403Z","affected":["smolagents@< 1.17.0 (fixed: 1.17.0)"],"epssScore":0.24573}],"checkedAt":"2026-10-09T21:48:58.007Z"},"meta":{"advisoryMatching":"by package name; advisory records do not state an ecosystem"}}