CVE-2025-5120: Huggingface Smolagents RCE Vulnerability

CVE-2025-5120 Overview

A critical sandbox escape vulnerability has been identified in Huggingface Smolagents version 1.14.0, enabling attackers to bypass the restricted execution environment and achieve remote code execution (RCE). The vulnerability resides in the local_python_executor.py module, which fails to adequately restrict Python code execution despite implementing both static and dynamic security checks. Attackers can exploit whitelisted modules and functions to execute arbitrary code, ultimately compromising the host system.

This flaw critically undermines the core security boundary designed to isolate untrusted code within the Smolagents framework. Organizations using Smolagents for AI agent orchestration face significant risks including unauthorized code execution, data leakage, and potential integration-level compromise across connected systems.

Critical Impact
This sandbox escape vulnerability enables remote attackers to achieve full code execution on the host system without authentication, bypassing all intended security isolation mechanisms. The vulnerability scores the maximum CVSS rating, indicating the highest possible risk to confidentiality, integrity, and availability.

Affected Products

Huggingface Smolagents version 1.14.0
Huggingface Smolagents versions prior to 1.17.0

Discovery Timeline

2025-07-27 - CVE-2025-5120 published to NVD
2025-08-07 - Last updated in NVD database

Technical Details for CVE-2025-5120

Vulnerability Analysis

The vulnerability is classified as CWE-94 (Improper Control of Generation of Code), commonly known as Code Injection. The local_python_executor.py module in Smolagents implements a sandbox environment intended to safely execute potentially untrusted Python code generated by AI agents. However, the security controls implemented through static analysis and dynamic runtime checks contain critical gaps that allow attackers to circumvent the intended isolation.

The sandbox relies on a whitelist approach for permitted modules and functions. Unfortunately, this whitelist contains entries that, when combined creatively, provide pathways to arbitrary code execution. The static analysis component fails to detect all dangerous code patterns, while the dynamic execution checks can be evaded through specific exploitation techniques that leverage allowed functionality in unintended ways.

Root Cause

The root cause stems from an incomplete security model in the sandbox implementation. The local_python_executor.py module attempts to restrict code execution by maintaining lists of allowed modules and functions. However, the inherent complexity of Python's import system and the interconnected nature of standard library modules create pathways that attackers can leverage to escape the restricted environment.

The sandbox fails to account for certain module interactions and attribute chains that, while individually appearing benign on the whitelist, can be combined to access dangerous functionality. This fundamental design flaw means that even with static and dynamic checks in place, determined attackers can craft payloads that pass all security validations while still achieving code execution outside the sandbox boundaries.

Attack Vector

The attack can be executed remotely over the network without requiring authentication or user interaction. An attacker can submit specially crafted Python code to a Smolagents instance, which the sandbox incorrectly classifies as safe for execution. Once the malicious code executes within the intended sandbox, it leverages whitelisted modules and functions in an unexpected manner to break out of the restricted environment.

The exploitation chain typically involves:

Identifying whitelisted modules that provide access to sensitive functionality
Constructing a payload that chains allowed operations to achieve sandbox escape
Executing arbitrary system commands or Python code with full host privileges
Potentially establishing persistence or lateral movement to connected systems

Since no proof-of-concept code is publicly available, refer to the Huntr Bounty Listing for additional technical details on the exploitation mechanism.

Detection Methods for CVE-2025-5120

Indicators of Compromise

Unexpected process spawning from Smolagents Python processes, particularly shell invocations or system command executions
Unusual network connections originating from the Smolagents service to external endpoints
Log entries showing attempts to access modules or functions outside normal agent operation patterns
File system modifications in directories outside the expected Smolagents working directories
Evidence of code execution artifacts such as dropped files, new user accounts, or modified configurations

Detection Strategies

Monitor Python process trees for child processes spawned by Smolagents instances that indicate shell or system command execution
Implement application-level logging to capture all code submitted for execution within the sandbox
Deploy behavioral analysis to identify anomalous module import patterns or function call sequences
Use endpoint detection to alert on privilege escalation attempts or sandbox escape indicators

Monitoring Recommendations

Enable verbose logging in Smolagents deployments to capture submitted code and execution traces
Configure network monitoring to detect outbound connections from Smolagents services to unexpected destinations
Implement file integrity monitoring on critical system directories accessible from the Smolagents host
Set up alerting for any process execution chains that deviate from baseline Smolagents operation

How to Mitigate CVE-2025-5120

Immediate Actions Required

Upgrade Smolagents to version 1.17.0 or later immediately, as this version contains the security fix
Audit logs for any suspicious activity on systems running vulnerable Smolagents versions
Implement network segmentation to limit the blast radius if exploitation has occurred
Review and restrict access to Smolagents instances to trusted users and applications only

Patch Information

Huggingface has released version 1.17.0 of Smolagents which resolves this sandbox escape vulnerability. The fix improves the security boundaries in the local_python_executor.py module to properly restrict code execution. Organizations should update their Smolagents installations immediately.

The patch commit can be reviewed at the GitHub Commit Details for technical analysis of the remediation.

Workarounds

Disable or restrict access to the local Python executor functionality if not required for your use case
Implement additional network-level controls to isolate Smolagents instances from sensitive systems
Deploy the Smolagents service in a containerized environment with minimal privileges and restricted capabilities
Implement strict input validation and code review for any code submitted to the Smolagents executor

bash

# Upgrade Smolagents to the patched version
pip install --upgrade smolagents>=1.17.0

# Verify the installed version
pip show smolagents | grep Version