Attack Chain

1. The attacker identifies an application or agent workflow utilizing a vulnerable version of the smolagents library.
2. The attacker triggers a function call that eventually invokes search_item_ctrl_f in vision_web_browser.py.
3. The attacker provides a specifically crafted malicious string as input to the affected function parameter.
4. The application logic concatenates the malicious input directly into an XPath query string.
5. The XPath engine executes the modified query, allowing the attacker to break out of the intended query context.
6. The attacker performs arbitrary DOM traversal to extract sensitive data or bypass intended input restrictions.

Impact

Successful exploitation can lead to local data extraction and information disclosure. The vulnerability affects users and automated agents using the smolagents library for vision-based web interaction. While the CVSS score is 5.4, the potential for unauthorized access to data processed or retrieved by AI agents presents a significant risk to the integrity of agent-driven automation workflows.

Recommendation

• Update the smolagents library to version 1.22.0 or later to patch the input validation flaw associated with CVE-2025-11844.
• Review applications utilizing smolagents to identify if any user-controlled input is passed directly to the search_item_ctrl_f function.
• Implement strict input validation and sanitization for all strings processed by the library in custom agent implementations until the library is patched.