CVE-2025-5120
Published: 27 July 2025
Summary
CVE-2025-5120 is a critical-severity Code Injection (CWE-94) vulnerability in Huggingface Smolagents. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Python (T1059.006); ranked in the top 39.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the LLM/Generative AI Risks risk domain.
The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and SC-18 (Mobile Code).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires confinement of mobile code, such as untrusted Python agent code, to approved execution domains, directly preventing sandbox escape and arbitrary code execution.
Mandates software-enforced separation and policy enforcement, addressing the inadequate static and dynamic checks in the local_python_executor.py module.
Implements a tamperproof reference monitor mediating all resource accesses, mitigating bypass of whitelisted modules and functions for RCE.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables attackers to bypass Python sandbox restrictions using whitelisted modules for arbitrary remote code execution, facilitating Python interpreter abuse (T1059.006) and exploitation to evade sandbox defenses (T1211).
NVD Description
A sandbox escape vulnerability was identified in huggingface/smolagents version 1.14.0, allowing attackers to bypass the restricted execution environment and achieve remote code execution (RCE). The vulnerability stems from the local_python_executor.py module, which inadequately restricts Python code execution despite employing static…
more
and dynamic checks. Attackers can exploit whitelisted modules and functions to execute arbitrary code, compromising the host system. This flaw undermines the core security boundary intended to isolate untrusted code, posing risks such as unauthorized code execution, data leakage, and potential integration-level compromise. The issue is resolved in version 1.17.0.
Deeper analysisAI
CVE-2025-5120 is a sandbox escape vulnerability affecting huggingface/smolagents version 1.14.0. The flaw resides in the local_python_executor.py module, which fails to adequately restrict Python code execution despite implementing static and dynamic checks. This allows attackers to leverage whitelisted modules and functions to execute arbitrary code, resulting in remote code execution (RCE) and undermining the intended isolation of untrusted code. The vulnerability carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and is classified under CWE-94 (Improper Control of Generation of Code).
Attackers with network access can exploit this vulnerability without authentication or user interaction, bypassing the sandbox to achieve RCE on the host system. Successful exploitation enables unauthorized code execution, data leakage, and potential compromise at the integration level, fully breaching the security boundary designed to contain untrusted code.
The issue has been resolved in smolagents version 1.17.0, as detailed in the patching commit at https://github.com/huggingface/smolagents/commit/33a942e62b6fbf6a35d41f1c735bda2d64c163d0. Additional details are available on the Huntr bounty report at https://huntr.com/bounties/63ab1cfe-b573-4cf5-a7d3-fb6c957e34b0, which reported the vulnerability.
This vulnerability is particularly relevant in AI/ML contexts, as smolagents is part of the Hugging Face ecosystem for executing lightweight AI agents, where sandboxing untrusted code is critical for safe model and agent deployment. No public evidence of real-world exploitation has been reported.
Details
- CWE(s)
Affected Products
AI Security AnalysisAI
- AI Category
- AI Agent Protocols and Integrations
- Risk Domain
- LLM/Generative AI Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- huggingface/smolagents is a library for AI agents involving sandboxed Python code execution, fitting AI Agent Protocols and Integrations due to its focus on secure execution environments for agent tools and integrations.