{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/smolagents--1.22.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:huggingface:smolagents:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":5.4,"id":"CVE-2025-11844"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["smolagents (\u003c 1.22.0)"],"_cs_severities":["low"],"_cs_tags":["vulnerability","xpath-injection","ai-security"],"_cs_type":"advisory","_cs_vendors":["Hugging Face"],"content_html":"\u003cp\u003eCVE-2025-11844 is an XPath injection vulnerability affecting the Hugging Face smolagents library in versions prior to 1.22.0. The vulnerability resides within the \u003ccode\u003esearch_item_ctrl_f\u003c/code\u003e function located in \u003ccode\u003evision_web_browser.py\u003c/code\u003e. This issue occurs because user-supplied input is directly concatenated into an internal XPath query string - specifically formatted as \u003ccode\u003e//*[contains(text(), 'USER_INPUT_HERE')]\u003c/code\u003e - without sufficient sanitization or validation. By crafting malicious input, an attacker can escape the intended query structure, facilitating arbitrary DOM traversal and potential information disclosure within environments utilizing the library for vision-based web browsing tasks. The availability of proof-of-concept scanning frameworks elevates the risk for organizations relying on this library for automated agentic workflows.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies an application or agent workflow utilizing a vulnerable version of the \u003ccode\u003esmolagents\u003c/code\u003e library.\u003c/li\u003e\n\u003cli\u003eThe attacker triggers a function call that eventually invokes \u003ccode\u003esearch_item_ctrl_f\u003c/code\u003e in \u003ccode\u003evision_web_browser.py\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker provides a specifically crafted malicious string as input to the affected function parameter.\u003c/li\u003e\n\u003cli\u003eThe application logic concatenates the malicious input directly into an XPath query string.\u003c/li\u003e\n\u003cli\u003eThe XPath engine executes the modified query, allowing the attacker to break out of the intended query context.\u003c/li\u003e\n\u003cli\u003eThe attacker performs arbitrary DOM traversal to extract sensitive data or bypass intended input restrictions.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation can lead to local data extraction and information disclosure. The vulnerability affects users and automated agents using the smolagents library for vision-based web interaction. While the CVSS score is 5.4, the potential for unauthorized access to data processed or retrieved by AI agents presents a significant risk to the integrity of agent-driven automation workflows.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the \u003ccode\u003esmolagents\u003c/code\u003e library to version 1.22.0 or later to patch the input validation flaw associated with CVE-2025-11844.\u003c/li\u003e\n\u003cli\u003eReview applications utilizing \u003ccode\u003esmolagents\u003c/code\u003e to identify if any user-controlled input is passed directly to the \u003ccode\u003esearch_item_ctrl_f\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation and sanitization for all strings processed by the library in custom agent implementations until the library is patched.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-21T04:16:21Z","date_published":"2026-10-21T04:16:21Z","id":"https://feed.craftedsignal.io/briefs/2026-10-smolagents-xpath-injection/","summary":"An XPath injection vulnerability in the Hugging Face smolagents library (CVE-2025-11844) allows for local data extraction and arbitrary DOM traversal via improper input validation in the search_item_ctrl_f function.","title":"Hugging Face smolagents: XPath injection in vision_web_browser.py (CVE-2025-11844)","url":"https://feed.craftedsignal.io/briefs/2026-10-smolagents-xpath-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Smolagents (\u003c 1.22.0)","version":"https://jsonfeed.org/version/1.1"}