CVE-2025-11844: Hugging Face Smolagents XXE Vulnerability

CVE-2025-11844 Overview

CVE-2025-11844 is an XPath injection vulnerability [CWE-643] affecting Hugging Face Smolagents version 1.20.0. The flaw resides in the search_item_ctrl_f function within src/smolagents/vision_web_browser.py. The function builds an XPath query by concatenating user-supplied input directly into the expression without sanitization or escaping.

Attackers can inject malicious XPath syntax to alter query logic, bypass search filters, and access unintended DOM elements. Successful exploitation disrupts web automation workflows, enables information disclosure, and manipulates AI agent interactions. The maintainers fixed the issue in Smolagents version 1.22.0.

Critical Impact
Attackers who influence agent input can hijack XPath queries executed by AI-driven browser automation, compromising the reliability and confidentiality of automated web tasks.

Affected Products

Hugging Face Smolagents version 1.20.0
Smolagents releases prior to 1.22.0 using vision_web_browser.py
AI agent deployments relying on the search_item_ctrl_f tool

Discovery Timeline

2025-10-22 - CVE-2025-11844 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11844

Vulnerability Analysis

Smolagents provides a vision-based web browser tool that AI agents use to navigate and interact with web pages. The search_item_ctrl_f tool implements a Ctrl+F-style page search by locating DOM elements whose text matches a user-provided string. Because the search term is inserted directly into an XPath expression, an attacker who controls that input can break out of the intended string literal and inject arbitrary XPath syntax.

The injected expression executes within the browsing context of the agent. This allows retrieval of DOM nodes the agent was not intended to see, coercion of the agent into acting on attacker-selected elements, and disruption of downstream automation logic. When Smolagents runs multi-step tasks, tampered search results can cascade into follow-on actions such as clicks, form submissions, or data extraction.

Root Cause

The root cause is missing neutralization of special elements in an XPath expression [CWE-643]. Single quotes, closing brackets, and axis specifiers within user input are not escaped before concatenation. Any character that has syntactic meaning in XPath 1.0 can therefore terminate the intended literal and introduce new predicates or function calls.

Attack Vector

Exploitation requires user interaction, since the malicious search term must reach the search_item_ctrl_f tool through agent input. In practice this can occur through prompt injection embedded in a visited web page, an attacker-controlled task description, or upstream content the agent summarizes and re-queries. No authentication or elevated privileges are required.

python

# Patch: introduces _escape_xpath_string() to safely quote user input
# Source: https://github.com/huggingface/smolagents/commit/f570ed5e17999d4cf7d5e79c2830fbaefab8a794

def _escape_xpath_string(s: str) -> str:
    """
    Escapes a string for safe use in an XPath expression.

    Args:
        s (`str`): Arbitrary input string to escape.

    Returns:
        `str`: Valid XPath expression representing the literal value of `s`.
    """
    if "'" not in s:
        return f"'{s}'"
    if '"' not in s:
        return f'"{s}"'
    parts = s.split("'")
    return "concat(" + ', "\'", '.join(f"'{p}'" for p in parts) + ")"


@tool
def search_item_ctrl_f(text: str, nth_result: int = 1) -> str:
    """
    ...
    """

The fix wraps user input in _escape_xpath_string, which produces a valid XPath literal for any input by choosing single quotes, double quotes, or an XPath concat() expression as appropriate.

Detection Methods for CVE-2025-11844

Indicators of Compromise

Agent logs containing search terms with unescaped single quotes, brackets, or XPath axis specifiers such as //, .., or parent::
Unexpected DOM elements returned by search_item_ctrl_f that do not match the literal search intent
Agent action traces where a search step is followed by interaction with elements outside the visible page region

Detection Strategies

Instrument vision_web_browser.py to log raw inputs to search_item_ctrl_f and flag characters with XPath syntactic meaning
Compare the Smolagents package version deployed in production against the fixed release 1.22.0 using software composition analysis
Review AI agent transcripts for prompt injection payloads that reference XPath primitives such as text(), contains(, or or 1=1

Monitoring Recommendations

Capture outbound browser automation activity and correlate it with the originating agent task to identify anomalous navigation paths
Alert on repeated failures or exceptions raised by the Selenium or Playwright driver invoked from search_item_ctrl_f
Track dependency manifests for smolagents versions below 1.22.0 across development and production environments

How to Mitigate CVE-2025-11844

Immediate Actions Required

Upgrade Smolagents to version 1.22.0 or later in every environment that runs agent-driven browser automation
Audit agent workflows that call search_item_ctrl_f and validate that untrusted content cannot reach the tool without review
Constrain agents to browse only trusted origins until the upgrade is deployed

Patch Information

The fix is delivered in Smolagents 1.22.0 via the GitHub commit f570ed5. The patch introduces the _escape_xpath_string helper and applies it to all user-controlled values passed into XPath queries in vision_web_browser.py. Additional context is available in the Huntr bounty listing.

Workarounds

Wrap or subclass search_item_ctrl_f locally to reject input containing XPath metacharacters until the upgrade is applied
Disable the vision_web_browser tool in agent tool registries where the browsing capability is not required
Apply prompt-injection filtering on web page content before it is passed into agent reasoning steps

bash

# Upgrade Smolagents to the patched release
pip install --upgrade "smolagents>=1.22.0"

# Verify the installed version
python -c "import smolagents; print(smolagents.__version__)"