CVE-2025-14931: Hugging Face smolagents RCE Vulnerability

CVE-2025-14931 Overview

CVE-2025-14931 is an unauthenticated remote code execution vulnerability in Hugging Face smolagents Remote Python Executor. The flaw resides in how the component parses pickle data received from external sources. Attackers can send crafted serialized payloads to trigger deserialization of untrusted data and execute arbitrary code in the context of the service account. The issue is tracked under Zero Day Initiative advisory ZDI-25-1143 (originally ZDI-CAN-28312) and is classified under CWE-502: Deserialization of Untrusted Data. No authentication or user interaction is required to exploit the flaw.

Critical Impact
Unauthenticated network attackers can achieve arbitrary code execution on hosts running vulnerable smolagents Remote Python Executor deployments, leading to full compromise of the agent runtime and any data or credentials it can access.

Affected Products

Hugging Face smolagents Remote Python Executor
Agent deployments embedding the Remote Python Executor component
Downstream integrations exposing the executor over the network

Discovery Timeline

2025-12-23 - CVE-2025-14931 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-14931

Vulnerability Analysis

The vulnerability exists in the Remote Python Executor component of Hugging Face smolagents, a framework for building and running LLM-driven agents. The executor accepts serialized Python objects encoded with the pickle module and reconstructs them without validating the source or contents of the stream. Python's pickle.loads deserializer invokes __reduce__ methods during object reconstruction, allowing arbitrary callables and arguments embedded in the byte stream to execute. An attacker who can deliver pickle data to the executor reaches code execution under the privileges of the service account hosting the agent runtime.

Root Cause

The root cause is unsafe deserialization of attacker-controlled bytes through pickle, mapped to [CWE-502]. The executor performs no integrity verification, signing, or sandboxing before unmarshalling input, and pickle is well-documented as unsafe for untrusted data. Any code path that funnels external input into pickle parsing inherits the full execution capability of the deserializer.

Attack Vector

Exploitation is performed over the network without authentication or user interaction. An attacker sends a crafted pickle payload containing a malicious __reduce__ directive to a reachable instance of the Remote Python Executor. Upon parsing, the executor invokes the embedded callable, for example os.system or subprocess.Popen, with attacker-chosen arguments. Successful exploitation grants code execution within the agent's process, enabling lateral movement, credential theft, model and prompt exfiltration, and tampering with agent outputs.

Technical details and reproduction notes are available in the Zero Day Initiative Advisory ZDI-25-1143.

Detection Methods for CVE-2025-14931

Indicators of Compromise

Inbound network traffic to the Remote Python Executor containing pickle opcodes such as \\x80\\x04 (protocol 4 header) or c__builtin__\nexec references.
Unexpected child processes spawned by the smolagents runtime, including shells (/bin/sh, bash, cmd.exe) or interpreters (python -c).
Outbound connections from the agent host to unfamiliar IPs immediately following deserialization activity.
Modifications to credentials, SSH keys, or scheduled tasks owned by the agent service account.

Detection Strategies

Inspect application logs for deserialization errors, abnormal payload sizes, or pickle parsing on endpoints that should not receive serialized input.
Deploy runtime monitoring on agent hosts to flag process lineage anomalies originating from the Python interpreter running smolagents.
Apply network detection rules that match pickle magic bytes and GLOBAL opcodes (c) referencing dangerous modules such as os, subprocess, or posix.

Monitoring Recommendations

Forward smolagents stdout, stderr, and audit logs to a centralized SIEM and alert on pickle.UnpicklingError, unexpected module imports, and traceback patterns.
Baseline normal agent behavior and alert on deviations such as new outbound destinations, file writes outside the workspace, or privilege changes.
Continuously verify exposure of executor endpoints to untrusted networks and alert on any public reachability.

How to Mitigate CVE-2025-14931

Immediate Actions Required

Remove the Remote Python Executor from any network position where untrusted clients can reach it, and place it behind authenticated, mutually authenticated transport.
Disable or remove pickle-based input handlers and reject any request whose body begins with pickle magic bytes.
Rotate credentials, API tokens, and model access keys accessible to the agent service account if exposure cannot be ruled out.
Run the executor under a least-privilege account inside a sandboxed container with no outbound internet access except to required endpoints.

Patch Information

No fixed version is identified in the NVD record at the time of writing. Monitor the Zero Day Initiative Advisory ZDI-25-1143 and the Hugging Face smolagents repository for an official patch and upgrade as soon as a corrected release is published.

Workarounds

Replace pickle with a safe serialization format such as JSON or msgpack with strict schema validation for any executor input.
Enforce cryptographic signing (for example HMAC-SHA256) on serialized payloads and reject any object whose signature cannot be verified against a known key.
Restrict the executor to localhost or a private network segment and require mTLS plus an allowlist of authorized callers.
Apply seccomp, AppArmor, or SELinux profiles that deny execve of shells and outbound network syscalls from the executor process.

bash

# Configuration example: restrict smolagents executor to localhost behind mTLS
# and block pickle content types at the reverse proxy

# nginx snippet
location /executor/ {
    if ($content_type ~* "application/(x-)?python-pickle") { return 415; }
    proxy_pass http://127.0.0.1:8000/;
    proxy_ssl_verify on;
    proxy_ssl_certificate     /etc/ssl/client.crt;
    proxy_ssl_certificate_key /etc/ssl/client.key;
}

# systemd hardening for the smolagents service
[Service]
User=smolagents
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
RestrictAddressFamilies=AF_INET AF_INET6
SystemCallFilter=~@privileged @debug @mount