repository icon
huggingface / smolagents Project repository

🤗 smolagents: a barebones library for agents that think in python code.

Submit a report

FIRST INTERACTION

WITHINN/A DAYS

REVIEW

WITHIN15 DAYS

FIX

WITHINN/A DAYS

Jinja2 SSTI via attacker-controlled prompt_templates in from_dict() enables OS R...
mambnub1
duplicate
Critical
LocalPythonExecutor timeout waits for blocked worker, allowing denial of service
ethanmbinns
duplicate
High
smolagents timeout waits for blocked code to finish
sravan27
duplicate
None
Sandbox Escape and Remote Code Execution (RCE) on Windows via Unblocked nt.syste...
root-aamir
informative
Critical
smolagents LocalPythonExecutor Sandbox Escape via Augmented Assignment Dunder By...
wulonchia-pro
informative
Critical
Sandbox Bypass via Missing Dunder Write Protection in LocalPythonExecutor
parallaxfx-343
informative
Medium
SSRF in VisitWebpageTool allows server to fetch internal services and cloud meta...
hoangperry
informative
High
LocalPythonInterpreter sandbox bypass: dunder attributes readable via str.format...
hoangperry
informative
Medium
Arbitrary Code Execution (RCE) via Sandbox Escape in LocalPythonExecutor (random...
ridhoajaaa
informative
Critical
str.format bypasses LocalPythonExecutor dunder restrictions and leaks tool globa...
raviakbar97
informative
Low
Tool.from_space uploads prompt-controlled local file paths to remote Spaces by d...
sakuyainazaki
informative
High
SSRF in default `VisitWebpageTool`: `requests.get(url)` with no URL validation a...
gunoooo
informative
High
Sandbox dunder-attribute filter bypass via str.format() field path access in loc...
turtlesmaster1
informative
Medium
LocalPythonExecutor timeout_seconds bypass via ThreadPoolExecutor — blocking cal...
yx350182449
informative
Medium
smolagents LocalPythonExecutor sandbox escape via frame object exposure
pyditn2
informative
High
Unbounded Memory Allocation via Unvalidated numpy dtype in SafeSerializer enable...
carrtik
informative
Medium
SSRF in VisitWebpageTool and AgentAudio — Agent Tools Fetch Attacker-Controlled...
dantecastelao
self closed
Systemic Sandbox Escape in LocalPythonExecutor via Native Dunder Invocation — 13...
dantecastelao
self closed
Local file exfiltration via Tool.from_space auto-wrapping of model-controlled st...
pablogar0
informative
High
LocalPythonExecutor timeout waits for worker completion, enabling denial of serv...
nguyencong2k
informative
Medium
Silent variable fuzzy-matching in LocalPythonExecutor leaks sensitive state data...
eserobe
informative
High
Shell injection via unsanitized package names in install_packages() allows RCE o...
pratikbarahatte87
duplicate
Critical
LocalPythonInterpreter ReDoS via re module bypasses execution timeout
colinm-sys
informative
Medium
LocalPythonInterpreter sandbox escape via __format__ dunder bypass
colinm-sys
informative
Critical
Tool.from_space() auto-uploads agent-controlled local file paths to remote Gradi...
arunacademy13-lang
informative
Medium
RCE via unsandboxed exec() in Tool.from_code() triggered by MultiStepAgent.from_...
nssys
self closed
Missing cleanup of temporary files on exception in tools.py and remote_executors...
merttturan
informative
Medium
Local Python Executor Sandbox Escape via Generator Frame `f_locals` Mutation
hacck3y
informative
High
Sandbox Escape and Remote Code Execution via with statement in LocalPythonExecut...
youssef-essam-swe
informative
Critical
SSRF via AgentImage/AgentAudio URL Fetch During Result Deserialization
jd-admrl-ai
informative
None
SSRF via VisitWebpageTool — Unrestricted Internal Network Access
jd-admrl-ai
informative
Critical
smolagents - Local Python Executor Timeout Bypass via ThreadPoolExecutor shutdow...
white-hat-lab
informative
High
Sandbox Escape and Information Disclosure via Formatted Value Dunder Attribute A...
0umutekinci
informative
Critical
Remote Code Execution (RCE) via Arbitrary Code Injection in Tool.from_dict()
0umutekinci
informative
Critical
smolagents VisitWebpageTool performs unvalidated HTTP requests enabling SSRF to...
elibell004
duplicate
None
CODENAME: GOT LESS MAN
shu4ya
informative
High
smolagents LocalPythonExecutor sandbox escape via traceback frame mutation of au...
mirr2
informative
High
Tool.from_space() auto-uploads local file path arguments to remote Gradio Spaces...
mirr2
informative
Medium
str.format() Bypasses All Sandbox Security Controls in LocalPythonExecutor
blockbrain-scanner
duplicate
High
LocalPythonExecutor sandbox escape via statistics.sys.modules — unauthorized acc...
ryanwms24
informative
Critical
LocalPythonExecutor Sandbox Bypass via str.format() Dunder Attribute Traversal
wulonchia-pro
informative
High
Arbitrary code execution via Tool.from_dict/from_folder bypassing trust_remote_c...
snakeyworm
informative
High
smolagents GradioUI remote denial of service via uncaught BaseException in CodeA...
gnesher
informative
High
SSRF via VisitWebpageTool + Sandbox Dunder Attribute Bypass in smolagents
snakeyworm
duplicate
None
Sandbox escape via asymmetric dunder protection — write-side allows __class__ as...
snakeyworm
duplicate
Critical
Sandbox Bypass via Unprotected setattr() Allows Dunder Attribute Writes in Local...
skillwager
duplicate
None
Unsanitized driver.current_url injected into agent observation memory
dfuselier
informative
Low
LocalPythonExecutor setattr/set_value Dunder Bypass — Complete Sandbox Escape
lexi-core-ai
duplicate
None
Sandbox escape via ctypes missing from DANGEROUS_MODULES in LocalPythonExecutor...
elliottower
informative
Critical
Sandbox Escape in LocalPythonExecutor via Augmented Assignment + __radd__ Chain...
skillwager
informative
Critical
str.format() Bypasses Dunder Sandbox in smolagents LocalPythonExecutor — Full Pr...
rael-ivar
duplicate
High
Arbitrary code execution via unsandboxed exec() in Tool.from_hub() — downloaded...
elliottower
informative
High
Cross-Site Scripting (XSS) via Jinja2 Autoescape Disabled in Gradio App Templa...
kulchandra-199
self closed
Sandbox escape via asymmetric dunder protection — write-side allows __class__ as...
wormysnake
duplicate
Critical
Sandbox Escape via Unprotected setattr() Allows Dunder Attribute Modification in...
lihfdgjr
duplicate
Critical
Sandbox Escape via Unguarded setattr Allows Dunder Attribute Writes Leading to R...
lihfdgjr
duplicate
High
LocalPythonExecutor sandbox bypass via str.format() dunder attribute access
colesmcintosh
duplicate
Medium
Command Injection via Unsanitized pip Install in RemoteExecutor (smolagents)
navneettsinghh
duplicate
Critical
Sandbox Escape via Generator Frame Locals Mutation Enables Arbitrary Code Execut...
aditya4727
duplicate
Critical
SSRF in AgentAudio.tensor via unvalidated URL in requests.get()
tranhoangtu-it
informative
Critical
Sandbox Escape via str.format() Attribute Resolution in Local Python Executor
caoxuyang
duplicate
Critical
Arbitrary Code Execution via raw exec() in Tool.from_code()
jdhart81
duplicate
Critical
Command injection via unsanitized package names in install_packages() for remote...
chrisabra-co
duplicate
Critical
Tool.from_code()` and `Tool.from_dict()` execute arbitrary code via exec() witho...
chrisabra-co
duplicate
High
Sandbox escape via pickle deserialization in remote executor return channel — al...
kodareef5
informative
Critical
Sandbox escape via dunder check bypass chain in LocalPythonExecutor, arbitrary f...
kodareef5
informative
Critical
Sandbox Escape via Asymmetric Dunder Attribute Check — Write Bypasses Read Prote...
nhomyk
informative
Critical
Sandbox Escape via Asymmetric Dunder Attribute Check — Writes Bypass Read Protec...
nhomyk
self closed
Sandbox Escape via Traceback Frame Access in Context Manager __exit__
montanaflynn
informative
Critical
Format String Bypass of Python Sandbox Dunder Attribute Restrictions (Post CVE-2...
snailsploit
duplicate
High
Circular Object Reference Causes Uncontrolled Resource Consumption in make_json_...
tru1hx
informative
Medium
`set_value()` in `LocalPythonExecutor` Does Not Check for Dunder Attribute Names...
hantul
informative
Medium
Sandbox escape via ctypes in LocalPythonExecutor allows arbitrary OS command exe...
rishavkumarthapa01-sketch
informative
High
Missing trust_remote_code safety check in from_dict() and from_folder() silently...
gprem-ctrl
duplicate
High
from_dict() and from_folder() bypass trust_remote_code gate and execute arbitrar...
gprem-ctrl
self closed
evaluate_name() in LocalPythonExecutor silently leaks sensitive state variables...
gprem-ctrl
informative
High
Unsandboxed exec() in Tool.from_hub() Enables RCE via Compromised Hub Space (No...
odysseypro25-project
duplicate
High
# Remote Code Execution via Tool.from_code() and Tool.from_dict() Code Injection
yhy0
duplicate
Critical
# Remote Code Execution via Jinja2 Server-Side Template Injection in populate_te...
yhy0
duplicate
Critical
Sandbox Protection Inconsistency in LocalPythonExecutor
yhy0
informative
Medium
SSRF in VisitWebpageTool via unrestricted backend URL fetch
midasavocado
informative
Medium
SSRF via VisitWebpageTool allows access to internal network services
lexi-core-ai
informative
High
Arbitrary Code Execution via Tool.from_code() without trust validation
lexi-core-ai
duplicate
Critical
SSRF in VisitWebpageTool allows access to internal services and cloud metadata
narrator3333-hash
informative
High
Sandbox Escape via evaluate_augassign() Dunder Attribute Bypass (CVE-2025-9959 b...
mscgo
informative
None
Command injection via malicious package names in remote executor install_package...
odysseypro25-project
informative
None
SSRF in default VisitWebpageTool — no URL validation allows access to internal n...
odysseypro25-project
informative
None
Python sandbox escape leading to Remote Code Execution (RCE) in huggingface/smol...
yulate
informative
Critical
Sandbox Escape in local_python_executor via augassign dunder bypass → RCE (bypas...
romain-deperne
duplicate
Critical
Python Sandbox Bypass via `__globals__` In-Place Mutation Enables Remote Code Ex...
apeiria-zero
informative
Critical
Unsafe deserialization via pickle in smolagents tool and agent serialization
etwithin
pending
Sandbox Dunder Protection Bypass and Arbitrary Attribute Injection via `get_curr...
hax1ng
duplicate
Critical
Jinja2 Server-Side Template Injection (SSTI) Leading to Remote Code Execution vi...
hax1ng
duplicate
Critical
Sandbox Escape to Arbitrary Command Execution via Context Manager Traceback Fram...
hax1ng
duplicate
Critical
Missing check_safer_result() in evaluate_call() allows DANGEROUS_FUNCTIONS bypas...
eigentum
duplicate
Critical
Sandbox Dunder Protection Bypass via Unguarded `setattr`, `set_value` Attribute...
hax1ng
duplicate
Critical
Sandbox Escape via Generator Frame Locals in LocalPythonExecutor
dorjoos
duplicate
Critical
Sandbox policy bypass: dunder attribute access not consistently enforced in AugA...
unicuervo16
informative
Medium
SSRF in VisitWebpageTool (smolagents)
alipayhihonor
duplicate
High
Multiple Sandbox Escapes in LocalPythonExecutor via Generator Frame Manipulation
zitoxxx
duplicate
None
zitoxxx
self closed
Sandbox Escape to Arbitrary Code Execution (RCE) in smolagents via evaluate_auga...
zitoxxx
duplicate
None
Server-Side Request Forgery (SSRF) in VisitWebpageTool
zitoxxx
duplicate
High
Remote Code Execution via Tool.from_dict() and Agent.from_folder() without trust...
optimus-fulcria
duplicate
High
Sandbox Information Leak via get_safe_module Unsafe Attribute Copying — Full Run...
l1iith
duplicate
Critical
Sandbox Bypass — Missing Dunder Access Controls in evaluate_call, set_value, and...
l1iith
duplicate
High
Sandbox Escape via Unsafe `pickle.loads()` of Sandbox-Controlled Data in Remote...
l1iith
pending
Arbitrary Code Execution via `from_dict` / `from_folder` / `Tool.from_dict` / `T...
l1iith
duplicate
High
Remote Code Execution (RCE) via Insecure Deserialization in remote_executors.py
askhat707
duplicate
Critical
Novel `yaml.load` Remote Code Execution (RCE) via Prompt Injection in `smolagen...
riskyrajiv
duplicate
Critical