repository icon
huggingface / smolagents Project repository

🤗 smolagents: a barebones library for agents that think in python code.

Submit a report

FIRST INTERACTION

WITHINN/A DAYS

REVIEW

WITHIN14 DAYS

FIX

WITHINN/A DAYS

SSRF in VisitWebpageTool and AgentAudio — Agent Tools Fetch Attacker-Controlled...
dantecastelao
self closed
Systemic Sandbox Escape in LocalPythonExecutor via Native Dunder Invocation — 13...
dantecastelao
self closed
RCE via unsandboxed exec() in Tool.from_code() triggered by MultiStepAgent.from_...
nssys
self closed
Remote Code Execution (RCE) via Arbitrary Code Injection in Tool.from_dict()
0umutekinci
informative
Critical
smolagents VisitWebpageTool performs unvalidated HTTP requests enabling SSRF to...
elibell004
duplicate
None
CODENAME: GOT LESS MAN
shu4ya
informative
High
smolagents LocalPythonExecutor sandbox escape via traceback frame mutation of au...
mirr2
informative
High
str.format() Bypasses All Sandbox Security Controls in LocalPythonExecutor
blockbrain-scanner
duplicate
High
Arbitrary code execution via Tool.from_dict/from_folder bypassing trust_remote_c...
snakeyworm
informative
High
SSRF via VisitWebpageTool + Sandbox Dunder Attribute Bypass in smolagents
snakeyworm
duplicate
None
Sandbox escape via asymmetric dunder protection — write-side allows __class__ as...
snakeyworm
duplicate
Critical
Sandbox Bypass via Unprotected setattr() Allows Dunder Attribute Writes in Local...
skillwager
duplicate
None
LocalPythonExecutor setattr/set_value Dunder Bypass — Complete Sandbox Escape
lexi-core-ai
duplicate
None
str.format() Bypasses Dunder Sandbox in smolagents LocalPythonExecutor — Full Pr...
rael-ivar
duplicate
High
Cross-Site Scripting (XSS) via Jinja2 Autoescape Disabled in Gradio App Templa...
kulchandra-199
self closed
Sandbox escape via asymmetric dunder protection — write-side allows __class__ as...
wormysnake
duplicate
Critical
Sandbox Escape via Unprotected setattr() Allows Dunder Attribute Modification in...
lihfdgjr
duplicate
Critical
Sandbox Escape via Unguarded setattr Allows Dunder Attribute Writes Leading to R...
lihfdgjr
duplicate
High
LocalPythonExecutor sandbox bypass via str.format() dunder attribute access
colesmcintosh
duplicate
Medium
Sandbox Escape via Generator Frame Locals Mutation Enables Arbitrary Code Execut...
aditya4727
duplicate
Critical
Sandbox Escape via str.format() Attribute Resolution in Local Python Executor
caoxuyang
duplicate
Critical
Arbitrary Code Execution via raw exec() in Tool.from_code()
jdhart81
duplicate
Critical
Tool.from_code()` and `Tool.from_dict()` execute arbitrary code via exec() witho...
chrisabra-co
duplicate
High
Sandbox escape via pickle deserialization in remote executor return channel — al...
kodareef5
informative
Critical
Sandbox escape via dunder check bypass chain in LocalPythonExecutor, arbitrary f...
kodareef5
informative
Critical
Sandbox Escape via Asymmetric Dunder Attribute Check — Writes Bypass Read Protec...
nhomyk
self closed
Sandbox Escape via Traceback Frame Access in Context Manager __exit__
montanaflynn
informative
Critical
Format String Bypass of Python Sandbox Dunder Attribute Restrictions (Post CVE-2...
snailsploit
duplicate
High
Circular Object Reference Causes Uncontrolled Resource Consumption in make_json_...
tru1hx
informative
Medium
Missing trust_remote_code safety check in from_dict() and from_folder() silently...
gprem-ctrl
duplicate
High
from_dict() and from_folder() bypass trust_remote_code gate and execute arbitrar...
gprem-ctrl
self closed
Unsandboxed exec() in Tool.from_hub() Enables RCE via Compromised Hub Space (No...
odysseypro25-project
duplicate
High
# Remote Code Execution via Tool.from_code() and Tool.from_dict() Code Injection
yhy0
duplicate
Critical
Sandbox Protection Inconsistency in LocalPythonExecutor
yhy0
informative
Medium
SSRF in VisitWebpageTool via unrestricted backend URL fetch
midasavocado
informative
Medium
SSRF via VisitWebpageTool allows access to internal network services
lexi-core-ai
informative
High
Arbitrary Code Execution via Tool.from_code() without trust validation
lexi-core-ai
duplicate
Critical
SSRF in VisitWebpageTool allows access to internal services and cloud metadata
narrator3333-hash
informative
High
SSRF in default VisitWebpageTool — no URL validation allows access to internal n...
odysseypro25-project
informative
None
Sandbox Escape in local_python_executor via augassign dunder bypass → RCE (bypas...
romain-deperne
duplicate
Critical
Sandbox Dunder Protection Bypass and Arbitrary Attribute Injection via `get_curr...
hax1ng
duplicate
Critical
Jinja2 Server-Side Template Injection (SSTI) Leading to Remote Code Execution vi...
hax1ng
duplicate
Critical
Sandbox Escape to Arbitrary Command Execution via Context Manager Traceback Fram...
hax1ng
duplicate
Critical
Missing check_safer_result() in evaluate_call() allows DANGEROUS_FUNCTIONS bypas...
eigentum
duplicate
Critical
Sandbox Dunder Protection Bypass via Unguarded `setattr`, `set_value` Attribute...
hax1ng
duplicate
Critical
Sandbox Escape via Generator Frame Locals in LocalPythonExecutor
dorjoos
duplicate
Critical
SSRF in VisitWebpageTool (smolagents)
alipayhihonor
duplicate
High
Multiple Sandbox Escapes in LocalPythonExecutor via Generator Frame Manipulation
zitoxxx
duplicate
None
zitoxxx
self closed
Sandbox Escape to Arbitrary Code Execution (RCE) in smolagents via evaluate_auga...
zitoxxx
duplicate
None
Server-Side Request Forgery (SSRF) in VisitWebpageTool
zitoxxx
duplicate
High
Remote Code Execution via Tool.from_dict() and Agent.from_folder() without trust...
optimus-fulcria
duplicate
High
# Smolagents WASM Sandbox Escape Vulnerability That Leads to RCE
vladimirelitokarev
duplicate
Critical
Sandbox Information Leak via get_safe_module Unsafe Attribute Copying — Full Run...
l1iith
duplicate
Critical
Sandbox Bypass — Missing Dunder Access Controls in evaluate_call, set_value, and...
l1iith
duplicate
High
Sandbox Escape via Unsafe `pickle.loads()` of Sandbox-Controlled Data in Remote...
l1iith
pending
Arbitrary Code Execution via `from_dict` / `from_folder` / `Tool.from_dict` / `T...
l1iith
duplicate
High
Remote Code Execution (RCE) via Insecure Deserialization in remote_executors.py
askhat707
duplicate
Critical
Novel `yaml.load` Remote Code Execution (RCE) via Prompt Injection in `smolagen...
riskyrajiv
duplicate
Critical
Novel Multi-Turn Remote Code Execution (RCE) via State Poisoning in smolagents C...
riskyrajiv
pending
Sandbox escape via with-statement traceback leak in LocalPythonExecutor
phenggeler
duplicate
Critical
Hugging Face smolagents V1.24.0 LocalPythonExecutor SSRF and Data Exfiltration
ch0ico
pending
Arbitrary Code Execution via Pickle Deserialization in Remote Executors
gitdavehorsley
duplicate
Critical
Arbitrary Code Execution via Pickle Deserialization in Remote Executors
l3ster1337
self closed
Unbounded Loop Causing Denial of Service in Remote Code Execution WebSocket Hand...
dillaryclump
informative
Medium
Data Integrity Violation in Parallel Tool Execution
dillaryclump
informative
High
Unauthenticated Sandbox Escape in LocalPythonExecutor via C-Level Format String...
chafik1234
duplicate
Critical
Remote Code Execution via Unsandboxed exec() in Tool.from_hub() and Tool.from_co...
phenggeler
duplicate
Critical
Remote Code Execution via unsafe pickle deserialization in remote executors
alan-tiger
duplicate
Critical
str.format() Bypasses nodunder_getattr Sandbox Protection Leading to Information...
alan-tiger
duplicate
Medium
Remote Code Execution via Insecure Pickle Deserialization in Remote Executors
reaperoak
duplicate
Critical
CSRF to Arbitrary Code Execution in Docker Container via Permissive CORS config
abhishekg999
informative
High
Critical Sandbox Escape in LocalPythonExecutor via setattr Mutability and Reflec...
riskyrajiv
duplicate
Critical
WASM executor sandbox escape - Deno server global cache dir poisoning
nnfrog
informative
High
DDOS via regular expression autorized in the code section
gliverneaux
informative
Medium
Deserialization of Untrusted Data
luffybounty18
duplicate
Critical
Remote Code Execution via Tool.from_code()
luffybounty18
duplicate
Critical
Arbitrary Environment Variable Disclosure and Sandbox Escape via Unvalidated Con...
herdiyana256
self closed
Configuration Injection via Environment Variables in smolagents
herdiyana256
informative
High
Security Filter Bypass in nodunder_getattr via String Subclassing
chmgx81
pending
Format String Sandbox Bypass in LocalPythonExecutor
sec0xed
informative
High