smolagents has Sandbox Escape Vulnerability in the local_python_executor.py Module

The impact of CVE-2025-5120 is severe. Successful exploitation allows an attacker to execute arbitrary code within the context of the smolagents process, effectively gaining control of the host system. This could lead to data theft, system compromise, and potential lateral movement within the network. The vulnerability's ability to bypass the intended sandbox significantly expands the attack surface, as it circumvents security measures designed to isolate untrusted code. The lack of robust restrictions on whitelisted modules means attackers can leverage seemingly benign functions to achieve malicious goals. This is particularly concerning in environments where smolagents is used to process untrusted input or interact with sensitive data.

Organizations using smolagents for tasks involving untrusted input or integration with external systems are particularly at risk. Development environments and CI/CD pipelines that utilize smolagents are also vulnerable, as they may be exposed to malicious code during the build or testing process. Users relying on shared hosting environments where smolagents is deployed should be aware of the potential for cross-tenant exploitation.

• python / smolagents:

import os
import subprocess

# Check for vulnerable version
process = subprocess.Popen(['pip', 'show', 'smolagents'], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
stdout, stderr = process.communicate()
if b'Version: 1.9.2' in stdout:
    print('Vulnerable version detected!')

# Check for suspicious file modifications
with open('/path/to/smolagents/local_python_executor.py', 'r') as f:
    content = f.read()
if 'os.system' in content:
    print('Suspicious code detected in local_python_executor.py')

1. 2025-07-27Disclosure

   disclosure

2. 2025-07-27Patch

   patch

1. Reserviert2025-05-23
2. Veröffentlicht2025-07-27
3. Geändert2025-08-07
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-5120 is to upgrade to version 1.17.0 or later of huggingface/smolagents. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict access to the localpythonexecutor.py module and carefully review the whitelisted modules and functions to ensure they are not exploitable. Implement strict input validation and sanitization to prevent malicious code from being injected into the execution environment. Monitor system logs for suspicious activity related to Python processes and smolagents execution. After upgrading, confirm the fix by attempting to execute code through the localpythonexecutor.py module and verifying that the sandbox restrictions are properly enforced.