CVE-2025-5120
Published: 27 July 2025
Summary
CVE-2025-5120 is a critical-severity Code Injection (CWE-94) vulnerability in Huggingface Smolagents. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Python (T1059.006); ranked in the top 16.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the LLM/Generative AI Risks risk domain.
The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and SC-18 (Mobile Code).
Deeper analysis
A sandbox escape vulnerability was identified in huggingface/smolagents version 1.14.0, specifically in the local_python_executor.py module. The component employs static and dynamic checks to restrict Python execution but fails to prevent use of whitelisted modules and functions, enabling attackers to bypass the sandbox and achieve remote code execution. The flaw carries a CVSS score of 10.0 and is tracked under CWE-94; it was fixed in version 1.17.0.
An unauthenticated attacker with network access can supply crafted code that abuses permitted imports and calls to escape the restricted environment, resulting in arbitrary command execution on the host, data exfiltration, or broader compromise of any system integrating the library. The attack requires no user interaction and breaks the core isolation boundary intended for untrusted agent-generated code.
The issue is addressed by the patch at commit 33a942e62b6fbf6a35d41f1c735bda2d64c163d0, with further details available in the associated huntr.com bounty report. The EPSS score has remained flat at 0.0187 since disclosure, indicating limited observed exploitation interest to date. The affected library is an AI agent framework, making the sandbox bypass particularly relevant to deployments that execute model-generated Python in shared or production environments.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-22815
Vulnerability details
A sandbox escape vulnerability was identified in huggingface/smolagents version 1.14.0, allowing attackers to bypass the restricted execution environment and achieve remote code execution (RCE). The vulnerability stems from the local_python_executor.py module, which inadequately restricts Python code execution despite employing static…
more
and dynamic checks. Attackers can exploit whitelisted modules and functions to execute arbitrary code, compromising the host system. This flaw undermines the core security boundary intended to isolate untrusted code, posing risks such as unauthorized code execution, data leakage, and potential integration-level compromise. The issue is resolved in version 1.17.0.
- CWE(s)
AI Security AnalysisAI
- AI Category
- AI Agent Protocols and Integrations
- Risk Domain
- LLM/Generative AI Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: huggingface
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables attackers to bypass Python sandbox restrictions using whitelisted modules for arbitrary remote code execution, facilitating Python interpreter abuse (T1059.006) and exploitation to evade sandbox defenses (T1211).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires confinement of mobile code, such as untrusted Python agent code, to approved execution domains, directly preventing sandbox escape and arbitrary code execution.
Mandates software-enforced separation and policy enforcement, addressing the inadequate static and dynamic checks in the local_python_executor.py module.
Implements a tamperproof reference monitor mediating all resource accesses, mitigating bypass of whitelisted modules and functions for RCE.