Hugging Face Smolagents CVE-2025-11844
MEDIUMSeverity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Network-delivered via web/agent content (AV:N), no auth needed (PR:N), but the agent must invoke the search on attacker-influenced input (UI:R); impact limited to data exposure and query manipulation (C:L/I:L, A:N).
Primary rating from Vendor (huntr).
CVSS VectorVendor: huntr
Lifecycle Timeline
3DescriptionCVE.org
Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py. The function constructs an XPath query by directly concatenating user-supplied input into the XPath expression without proper sanitization or escaping. This allows an attacker to inject malicious XPath syntax that can alter the intended query logic. The vulnerability enables attackers to bypass search filters, access unintended DOM elements, and disrupt web automation workflows. This can lead to information disclosure, manipulation of AI agent interactions, and compromise the reliability of automated web tasks. The issue is fixed in version 1.22.0.
AnalysisAI
XPath injection in Hugging Face Smolagents 1.20.0 lets an attacker who can influence the text passed to the vision web browser's Ctrl-F style search (search_item_ctrl_f) rewrite the underlying XPath query, bypassing intended search filters and pulling in unintended DOM elements. The flaw is reachable without authentication (CVSS PR:N) but requires the agent or user to trigger the search with attacker-influenced text (UI:R), so it is not passively exploitable; impact is bounded to information disclosure from the queried page, manipulation of agent search results, and disruption of automation workflows rather than code execution. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.28% (19th percentile), making this a moderate, situational risk rather than a high-priority emergency.
Technical ContextAI
Smolagents' vision_web_browser module automates a Selenium WebDriver to drive an LLM agent through web pages, and the search_item_ctrl_f helper emulates a browser Ctrl-F by calling driver.find_elements(By.XPATH, ...) with a query built through direct Python f-string interpolation: //*[contains(text(), '{text}')]. Because the caller-supplied text string is concatenated into the XPath literal without escaping, a payload containing a single quote (for example, ')] | //user[contains(@role,'admin')] | foo[contains(text(), ') terminates the string literal and appends arbitrary XPath, which is the classic Improper Neutralization of Data within XPath Expressions weakness (CWE-643). XPath injection is the XML-path analogue of SQL injection: it cannot execute system code, but it can read or address nodes the developer never intended, alter predicate logic (e.g., 'or 1=1'), and skew the result set the agent acts upon. The upstream fix at commit f570ed5e17999d4cf7d5e79c2830fbaefab8a794 introduces an _escape_xpath_string helper that wraps input in single quotes, falls back to double quotes when a single quote is present, and builds a concat('...', "'", '...') expression when both quote characters occur, then passes the escaped value into contains(text(), {escaped_text}) so hostile syntax is treated as a literal. A new test suite (tests/test_vision_web_browser.py) exercises quote handling and representative injection payloads to confirm the escaping.
RemediationAI
Upgrade Smolagents to version 1.22.0, which contains the vendor-released patch that adds the _escape_xpath_string helper and routes search_item_ctrl_f input through it; the fix is visible in the upstream commit https://github.com/huggingface/smolagents/commit/f570ed5e17999d4cf7d5e79c2830fbaefab8a794. If an immediate upgrade is not possible, apply the upstream commit or vendor the escaping helper into the local copy of src/smolagents/vision_web_browser.py, since the change is small and self-contained (quoting plus a concat() fallback for mixed-quote input) and has no expected functional side effects on legitimate searches. As compensating controls, treat the search text as untrusted: sanitize or whitelist the text supplied by the agent before it reaches search_item_ctrl_f, and constrain the agent to fetch and search only trusted, first-party pages so attacker-controlled page content cannot be reflected into the search term through prompt injection. Blocking or sandboxing outbound browsing does not remove the flaw but limits what an injected XPath query can read, at the cost of reducing the automation's usefulness, and the huntr report at https://huntr.com/bounties/01ab4405-9bca-4b26-b7a3-5ca1863a69b4 provides the reporter's reproduction details for validation testing.
More in Smolagents
View allServer-side request forgery in Hugging Face smolagents 1.24.0 allows authenticated attackers to manipulate the LocalPyth
Code injection in HuggingFace smolagents 1.25.0.dev0 allows remote attackers without authentication to execute arbitrary
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today