Hugging Face Smolagents hat ein Injection Problem

Successful exploitation of CVE-2026-4963 allows an attacker to inject and execute arbitrary code within the context of the smolagents application. This could lead to complete system compromise, including data exfiltration, privilege escalation, and the installation of malware. Given the availability of a public exploit, the potential for widespread attacks is significant. The vulnerability's location within the Python executor suggests that attackers could target sensitive data processed by smolagents, potentially impacting any downstream systems relying on its output. The incomplete nature of the fix suggests that this vulnerability may share underlying causes with CVE-2025-9959, potentially expanding the attack surface.

Organizations utilizing huggingface smolagents in production environments, particularly those processing sensitive data or integrating with other critical systems, are at significant risk. Systems running older, unpatched versions of smolagents are especially vulnerable. Users relying on smolagents for automated tasks or decision-making processes are also at increased risk, as successful exploitation could lead to malicious actions being performed without their knowledge.

• python / localpythonexecutor.py: Monitor Python processes for unusual activity, especially those executing code from src/smolagents/localpythonexecutor.py. Use ps or top to identify suspicious processes.

ps aux | grep 'local_python_executor.py'

• python / supply-chain: Check for unusual imports or function calls within the evaluateaugassign/evaluatecall/evaluate_with function. Examine the smolagents dependencies for vulnerabilities using pip audit.

pip audit

• generic web: Monitor web server access logs for requests targeting localpythonexecutor.py with unusual parameters.

 grep 'local_python_executor.py' access.log

1. 2026-03-27Disclosure

   disclosure

2. 2026-03-27PoC

   poc

1. Reserviert2026-03-27
2. Veröffentlicht2026-03-27
3. Geändert2026-03-31
4. EPSS aktualisiert2026-04-04

The primary mitigation for CVE-2026-4963 is to upgrade to a patched version of huggingface smolagents. Unfortunately, no fixed version is currently specified. Until a patch is released, consider implementing temporary workarounds. Input validation and sanitization within the evaluateaugassign/evaluatecall/evaluate_with function can help prevent malicious code injection. Restrict network access to the smolagents application to only trusted sources. Monitor system logs for suspicious activity, particularly related to Python execution and file modifications. After upgrading (when available), confirm the fix by attempting to trigger the vulnerable function with a known malicious payload and verifying that it is properly sanitized.