PT-2025-35805 · Pypi · Smolagents

Nnfrog · Publicado 2025-09-03 · Atualizado 2026-05-24 · CVE-2025-9959

Positive Technologies (AI Summary)

CVSS v3.1

7.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions smolagents (affected versions not specified)

Description Incomplete validation of dunder attributes allows an attacker to escape from the Local Python execution environment sandbox enforced by the software. The attack requires a Prompt Injection to trick the agent into creating malicious code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2025-9959

Produtos afetados

Smolagents

Referências · 7

• https://github.com/huggingface/smolagents/pull/1551 · Correção
• https://twitter.com/CVEnew/status/1963293582820864138 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-9959 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-9959 · Aviso do Fabricante
• https://research.jfrog.com/vulnerabilities/smolagents-local-python-sandbox-escape-jfsa-2025-001434277 · Nota
• https://t.me/CVEtracker/31614 · Publicação no Telegram
• https://twitter.com/HugoValters/status/2058540518985081089 · Publicação no Twitter