CVE database · Agent frameworks and SDKs
smolagents vulnerabilities and CVEs
The Beam CVE database tracks 5 security advisories for smolagents: 2 critical, 1 medium and 2 low severity. The newest is CVE-2026-4963, published Mar 27, 2026.
Hugging Face's library for agents that write and run Python code as their actions.
Check your version: pip show smolagents
- Vulnerabilities tracked
- 5
- Critical
- 2
- Known exploited (CISA KEV)
- 0
- Published in the last 30 days
- 0
All entries, newest first
CVE-2026-4963
Hugging Face Smolagents has an Injection issue
low6.3No fixMar 27, 2026CVE-2026-2654
Hugging Face Smolagents has a Server-Side Request Forgery issue
low6.3No fixFeb 18, 2026CVE-2025-14931
Hugging Face smolagents: Unsafe deserialization in Remote Python Executor leads to RCE
critical10.0No fixDec 23, 2025CVE-2025-11844
Hugging Face Smolagents XPath injection vulnerability in the search_item_ctrl_f function
medium5.4Oct 22, 2025CVE-2025-5120
smolagents has Sandbox Escape Vulnerability in the local_python_executor.py Module
critical9.9Jul 27, 2025