Skip to content
Threat Feed
Subscribe

Product

Smolagents (< 1.22.0)

1 brief RSS
low advisory

Hugging Face smolagents: XPath injection in vision_web_browser.py (CVE-2025-11844)

An XPath injection vulnerability in the Hugging Face smolagents library (CVE-2025-11844) allows for local data extraction and arbitrary DOM traversal via improper input validation in the search_item_ctrl_f function.

smolagents vulnerability xpath-injection ai-security
1t 1c