Hugging Face smolagents: XPath injection in vision_web_browser.py (CVE-2025-11844)

CVE-2025-11844 is an XPath injection vulnerability affecting the Hugging Face smolagents library in versions prior to 1.22.0. The vulnerability resides within the search_item_ctrl_f function located in vision_web_browser.py. This issue occurs because user-supplied input is directly concatenated into an internal XPath query string - specifically formatted as //*[contains(text(), 'USER_INPUT_HERE')] - without sufficient sanitization or validation. By crafting malicious input, an attacker can escape the intended query structure, facilitating arbitrary DOM traversal and potential information disclosure within environments utilizing the library for vision-based web browsing tasks. The availability of proof-of-concept scanning frameworks elevates the risk for organizations relying on this library for automated agentic workflows.

Attack Chain

1. The attacker identifies an application or agent workflow utilizing a vulnerable version of the smolagents library.
2. The attacker triggers a function call that eventually invokes search_item_ctrl_f in vision_web_browser.py.
3. The attacker provides a specifically crafted malicious string as input to the affected function parameter.
4. The application logic concatenates the malicious input directly into an XPath query string.
5. The XPath engine executes the modified query, allowing the attacker to break out of the intended query context.
6. The attacker performs arbitrary DOM traversal to extract sensitive data or bypass intended input restrictions.

Impact

Successful exploitation can lead to local data extraction and information disclosure. The vulnerability affects users and automated agents using the smolagents library for vision-based web interaction. While the CVSS score is 5.4, the potential for unauthorized access to data processed or retrieved by AI agents presents a significant risk to the integrity of agent-driven automation workflows.

Recommendation

• Update the smolagents library to version 1.22.0 or later to patch the input validation flaw associated with CVE-2025-11844.
• Review applications utilizing smolagents to identify if any user-controlled input is passed directly to the search_item_ctrl_f function.
• Implement strict input validation and sanitization for all strings processed by the library in custom agent implementations until the library is patched.