repository icon
huggingface / smolagents Project repository

🤗 smolagents: a barebones library for agents that think in python code.

Submit a report

FIRST INTERACTION

WITHINN/A DAYS

REVIEW

WITHIN15 DAYS

FIX

WITHINN/A DAYS

Tool.from_code() passes attacker-controlled string to exec() with no sandboxing,...
gabrieltokusev-cell
duplicate
Critical
setattr() is exposed unwrapped in LocalPythonExecutor, allowing dunder-attribute...
lhmisme420
duplicate
Low
Unrestricted exec() in Tool.from_code() leads to Remote Code Execution
xiaoyaoyou2
duplicate
Critical
smolagents logs Jupyter kernel auth tokens on failure
michellehumes
informative
Medium
Jinja2 SSTI via attacker-controlled prompt_templates in from_dict() enables OS R...
mambnub1
duplicate
Critical
LocalPythonExecutor timeout waits for blocked worker, allowing denial of service
ethanmbinns
duplicate
High
smolagents timeout waits for blocked code to finish
sravan27
duplicate
None
Sandbox Escape and Remote Code Execution (RCE) on Windows via Unblocked nt.syste...
root-aamir
informative
Critical
smolagents LocalPythonExecutor Sandbox Escape via Augmented Assignment Dunder By...
wulonchia-pro
informative
Critical
Sandbox Bypass via Missing Dunder Write Protection in LocalPythonExecutor
parallaxfx-343
informative
Medium
SSRF in VisitWebpageTool allows server to fetch internal services and cloud meta...
hoangperry
informative
High
LocalPythonInterpreter sandbox bypass: dunder attributes readable via str.format...
hoangperry
informative
Medium
Arbitrary Code Execution (RCE) via Sandbox Escape in LocalPythonExecutor (random...
ridhoajaaa
informative
Critical
str.format bypasses LocalPythonExecutor dunder restrictions and leaks tool globa...
raviakbar97
informative
Low
Tool.from_space uploads prompt-controlled local file paths to remote Spaces by d...
sakuyainazaki
informative
High
SSRF in default `VisitWebpageTool`: `requests.get(url)` with no URL validation a...
gunoooo
informative
High
Sandbox dunder-attribute filter bypass via str.format() field path access in loc...
turtlesmaster1
informative
Medium
LocalPythonExecutor timeout_seconds bypass via ThreadPoolExecutor — blocking cal...
yx350182449
informative
Medium
smolagents LocalPythonExecutor sandbox escape via frame object exposure
pyditn2
informative
High
Unbounded Memory Allocation via Unvalidated numpy dtype in SafeSerializer enable...
carrtik
informative
Medium
SSRF in VisitWebpageTool and AgentAudio — Agent Tools Fetch Attacker-Controlled...
dantecastelao
self closed
Systemic Sandbox Escape in LocalPythonExecutor via Native Dunder Invocation — 13...
dantecastelao
self closed
Local file exfiltration via Tool.from_space auto-wrapping of model-controlled st...
pablogar0
informative
High
Sensitive Token and Credential Disclosure via Kernel-Creation Error Logging in _...
pablogar0
informative
Medium
LocalPythonExecutor timeout waits for worker completion, enabling denial of serv...
nguyencong2k
informative
Medium
Silent variable fuzzy-matching in LocalPythonExecutor leaks sensitive state data...
eserobe
informative
High
Shell injection via unsanitized package names in install_packages() allows RCE o...
pratikbarahatte87
duplicate
Critical
LocalPythonInterpreter ReDoS via re module bypasses execution timeout
colinm-sys
informative
Medium
LocalPythonInterpreter sandbox escape via __format__ dunder bypass
colinm-sys
informative
Critical
Tool.from_space() auto-uploads agent-controlled local file paths to remote Gradi...
arunacademy13-lang
informative
Medium
RCE via unsandboxed exec() in Tool.from_code() triggered by MultiStepAgent.from_...
nssys
self closed
Missing cleanup of temporary files on exception in tools.py and remote_executors...
merttturan
informative
Medium
Local Python Executor Sandbox Escape via Generator Frame `f_locals` Mutation
hacck3y
informative
High
Sandbox Escape and Remote Code Execution via with statement in LocalPythonExecut...
youssef-essam-swe
informative
Critical
SSRF via AgentImage/AgentAudio URL Fetch During Result Deserialization
jd-admrl-ai
informative
None
SSRF via VisitWebpageTool — Unrestricted Internal Network Access
jd-admrl-ai
informative
Critical
smolagents - Local Python Executor Timeout Bypass via ThreadPoolExecutor shutdow...
white-hat-lab
informative
High
Sandbox Escape and Information Disclosure via Formatted Value Dunder Attribute A...
0umutekinci
informative
Critical
Remote Code Execution (RCE) via Arbitrary Code Injection in Tool.from_dict()
0umutekinci
informative
Critical
smolagents VisitWebpageTool performs unvalidated HTTP requests enabling SSRF to...
elibell004
duplicate
None
CODENAME: GOT LESS MAN
shu4ya
informative
High
smolagents LocalPythonExecutor sandbox escape via traceback frame mutation of au...
mirr2
informative
High
Tool.from_space() auto-uploads local file path arguments to remote Gradio Spaces...
mirr2
informative
Medium
str.format() Bypasses All Sandbox Security Controls in LocalPythonExecutor
blockbrain-scanner
duplicate
High
LocalPythonExecutor sandbox escape via statistics.sys.modules — unauthorized acc...
ryanwms24
informative
Critical
LocalPythonExecutor Sandbox Bypass via str.format() Dunder Attribute Traversal
wulonchia-pro
informative
High
Arbitrary code execution via Tool.from_dict/from_folder bypassing trust_remote_c...
snakeyworm
informative
High
smolagents GradioUI remote denial of service via uncaught BaseException in CodeA...
gnesher
informative
High
SSRF via VisitWebpageTool + Sandbox Dunder Attribute Bypass in smolagents
snakeyworm
duplicate
None
Sandbox escape via asymmetric dunder protection — write-side allows __class__ as...
snakeyworm
duplicate
Critical
Sandbox Bypass via Unprotected setattr() Allows Dunder Attribute Writes in Local...
skillwager
duplicate
None
Unsanitized driver.current_url injected into agent observation memory
dfuselier
informative
Low
LocalPythonExecutor setattr/set_value Dunder Bypass — Complete Sandbox Escape
lexi-core-ai
duplicate
None
Forged FinalAnswerException Payload Escapes Remote Executor Sandbox via Uncondit...
rael-ivar
pending
Sandbox escape via ctypes missing from DANGEROUS_MODULES in LocalPythonExecutor...
elliottower
informative
Critical
Sandbox Escape in LocalPythonExecutor via Augmented Assignment + __radd__ Chain...
skillwager
informative
Critical
str.format() Bypasses Dunder Sandbox in smolagents LocalPythonExecutor — Full Pr...
rael-ivar
duplicate
High
Arbitrary code execution via unsandboxed exec() in Tool.from_hub() — downloaded...
elliottower
informative
High
smolagents MCPClient: AWS credential theft + SSRF via malicious MCP server $ref...
addcontent
pending
Arbitrary code execution via unsafe pickle.loads on base64-decoded data in 5 ser...
elliottower
pending
Cross-Site Scripting (XSS) via Jinja2 Autoescape Disabled in Gradio App Templa...
kulchandra-199
self closed
Sandbox escape via asymmetric dunder protection — write-side allows __class__ as...
wormysnake
duplicate
Critical
Sandbox Escape via Unprotected setattr() Allows Dunder Attribute Modification in...
lihfdgjr
duplicate
Critical
Sandbox Escape via Unguarded setattr Allows Dunder Attribute Writes Leading to R...
lihfdgjr
duplicate
High
Path Traversal to Arbitrary Code Execution in smolagents Agent.from_folder()
ryan-fanpierlabs-security-finder
pending
LocalPythonExecutor sandbox bypass via str.format() dunder attribute access
colesmcintosh
duplicate
Medium
Multiple Security Vulnerabilities: XXE, Unsafe Downloads, Missing Timeouts
regg819
pending
Command Injection via Unsanitized pip Install in RemoteExecutor (smolagents)
navneettsinghh
duplicate
Critical
Sandbox Escape via Generator Frame Locals Mutation Enables Arbitrary Code Execut...
aditya4727
duplicate
Critical
SSRF in AgentAudio.tensor via unvalidated URL in requests.get()
tranhoangtu-it
informative
Critical
Sandbox Escape via str.format() Attribute Resolution in Local Python Executor
caoxuyang
duplicate
Critical
Arbitrary Code Execution via raw exec() in Tool.from_code()
jdhart81
duplicate
Critical
Residual unsafe `allow_pickle=True` defaults in internal functions after partial...
chrisabra-co
pending
Command injection via unsanitized package names in install_packages() for remote...
chrisabra-co
duplicate
Critical
Tool.from_code()` and `Tool.from_dict()` execute arbitrary code via exec() witho...
chrisabra-co
duplicate
High
Sandbox escape via pickle deserialization in remote executor return channel — al...
kodareef5
informative
Critical
Sandbox escape via dunder check bypass chain in LocalPythonExecutor, arbitrary f...
kodareef5
informative
Critical
Sandbox Escape via Asymmetric Dunder Attribute Check — Write Bypasses Read Prote...
nhomyk
informative
Critical
Sandbox Escape via Asymmetric Dunder Attribute Check — Writes Bypass Read Protec...
nhomyk
self closed
Auth Token Leaked in Error Logs via URL and Request Headers in _create_kernel_ht...
javitoia
informative
Medium
Sandbox Escape via Traceback Frame Access in Context Manager __exit__
montanaflynn
informative
Critical
Format String Bypass of Python Sandbox Dunder Attribute Restrictions (Post CVE-2...
snailsploit
duplicate
High
RCE via exec() on tool code loaded from HuggingFace Hub + pickle deserialization...
nhomyk
informative
Critical
Circular Object Reference Causes Uncontrolled Resource Consumption in make_json_...
tru1hx
informative
Medium
`set_value()` in `LocalPythonExecutor` Does Not Check for Dunder Attribute Names...
hantul
informative
Medium
`tool.name` Mutation After Initialization Bypasses `is_valid_name()` Validation,...
hantul
pending
Sandbox escape via ctypes in LocalPythonExecutor allows arbitrary OS command exe...
rishavkumarthapa01-sketch
informative
High
Missing trust_remote_code safety check in from_dict() and from_folder() silently...
gprem-ctrl
duplicate
High
from_dict() and from_folder() bypass trust_remote_code gate and execute arbitrar...
gprem-ctrl
self closed
evaluate_name() in LocalPythonExecutor silently leaks sensitive state variables...
gprem-ctrl
informative
High
Unsandboxed exec() in Tool.from_hub() Enables RCE via Compromised Hub Space (No...
odysseypro25-project
duplicate
High
# Remote Code Execution via Tool.from_code() and Tool.from_dict() Code Injection
yhy0
duplicate
Critical
# Remote Code Execution via Jinja2 Server-Side Template Injection in populate_te...
yhy0
duplicate
Critical
Sandbox Protection Inconsistency in LocalPythonExecutor
yhy0
informative
Medium
SSRF in VisitWebpageTool via unrestricted backend URL fetch
midasavocado
informative
Medium
Path Traversal in from_folder() enables arbitrary code execution via crafted age...
lexi-core-ai
pending
SSRF via VisitWebpageTool allows access to internal network services
lexi-core-ai
informative
High
Arbitrary Code Execution via Tool.from_code() without trust validation
lexi-core-ai
duplicate
Critical