Hugging Face · Smolagents · CVE-2026-4963
**Name of the Vulnerable Software and Affected Versions**
huggingface smolagents version 1.25.0.dev0
**Description**
A code injection flaw allows remote attackers to execute arbitrary code. The issue resides in the `evaluate augassign()`, `evaluate call()`, and `evaluate with()` functions within the `src/smolagents/local python executor.py` file.
**Recommendations**
As a temporary workaround, consider restricting the use of the `evaluate augassign()`, `evaluate call()`, and `evaluate with()` functions in the `src/smolagents/local python executor.py` file until a patch is available.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.