CriticalVulnerability
CVE-2025-5120: huggingface/smolagents sandbox escape allowing remote code execution
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2025-5120
- Published
- Record updated
- Affected
- smolagents < 1.17.0
- Fixed in
- 1.17.0
- released May 27, 2025, 61 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 31.2%
Summary
A sandbox escape in huggingface/smolagents version 1.14.0 lets attackers bypass the restricted execution environment and achieve remote code execution (RCE). The flaw stems from local_python_executor.py, which inadequately restricts Python code execution despite static and dynamic checks. Attackers can exploit whitelisted modules and functions to run arbitrary code and compromise the host system.
Mitigation
The issue is resolved in version 1.17.0.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- smolagentsPyPILLM dependency since 2024-12-27 · 7 tracked dependents
Related items
- HighCVE-2026-119120: Crawl4AI Docker API lets clients choose the HuggingFace model it loadsSame vendor · NVD/CVE Database
- HighGHSA-wf6j-7hvr-gr93: Hydra legacy target blacklist permits unsafe PyYAML loadingSame vendor · Hugging Face Security Advisories
- MediumCVE-2026-100653: vLLM unpinned Hugging Face artifact loads for FunAudioChat and Tarsier2Same vendor · NVD/CVE Database
- HighGHSA-3hmm-rh5q-gwwr: LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loadingSame vendor · Hugging Face Security Advisories
- MediumCVE-2026-80047: Hugging Face Transformers writes remote Python files to disk before trust checkSame vendor · NVD/CVE Database