Hugging Face smolagents CVE-2025-14931

Exploitation requires that the target deploys and exposes Hugging Face smolagents' remote Python executor such that attacker-controlled data reaches the pickle parsing/deserialization path; the specific flaw is unsafe deserialization of untrusted pickle data (CWE-502) with no validation of user-supplied input. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is needed once that path is reachable, so the primary limiting factor is network reachability of the vulnerable executor endpoint and whether the deployment feeds untrusted/externally-sourced data into deserialization - deployments that do not expose the remote executor to untrusted input are not exploitable. Impact is bounded by the privileges of the service account running smolagents.

All severity signals point to maximum technical severity: the CVSS 3.0 base score is 10.0 with AV:N/AC:L/PR:N/UI:N and full C:H/I:H/A:H plus a scope change (S:C), meaning an unauthenticated, remote, low-complexity attacker can achieve arbitrary code execution - consistent with the CWE-502 (deserialization of untrusted data / pickle) root cause described. However, the exploitation-likelihood signals are far more muted and partially conflicting with the 'critical' headline: EPSS is only 1.09% (65th percentile), there is no CISA KEV listing, and no public POC is referenced in the provided data, so this is best characterized as a high-impact but not-yet-widely-exploited issue. The vulnerability was reported through Trend Micro's Zero Day Initiative (ZDI-25-1143 / ZDI-CAN-28312), which indicates a coordinated-disclosure research finding rather than observed in-the-wild abuse. The practical risk is therefore highly deployment-dependent: because pickle-based RCE is trivially weaponizable once input reaches the vulnerable deserialization path, the gating factor is exposure of the smolagents remote Python executor to untrusted input, not attack difficulty. Note the signal tension explicitly: CVSS indicates trivial network exploitation while EPSS/KEV indicate no confirmed mass exploitation, suggesting the real-world risk is concentrated in environments that actually expose smolagents' remote executor to untrusted data rather than being broadly opportunistic.

An attacker who can reach a smolagents deployment that uses the remote Python executor submits a crafted pickle payload to the deserialization path; because the data is not validated, unpickling instantiates attacker-controlled objects that execute arbitrary code in the context of the service account. No authentication or user interaction is required (PR:N/UI:N), and the low attack complexity (AC:L) means a single crafted request suffices. No public exploit code is identified at time of analysis, but pickle-deserialization flaws are trivially weaponizable.