CVE-2026-4963

Katalog CVE

CVSS 10.0 · Critical EPSS 0,73%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada huggingface smolagents. Skor CVSS 3.1 10.0 (Critical) menurut NVD.

Deskripsi (NVD)

A weakness has been identified in huggingface smolagents 1.25.0.dev0. This affects the function evaluate_augassign/evaluate_call/evaluate_with of the file src/smolagents/local_python_executor.py of the component Incomplete Fix CVE-2025-9959. This manipulation causes code injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Rincian

Terbit di NVD

27 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

10.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,73% peluang dieksploitasi; lebih tinggi dari 53,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/YLChen-007/35b7d46e892266a0ed6dbe57802858be exploit · advisory pihak ketiga
• https://gist.github.com/YLChen-007/7146f45960f79bc1e2976fed526e0a9b exploit · advisory pihak ketiga
• https://vuldb.com/?id.353840 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.777623 exploit · advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.777643 exploit · advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.777644 exploit · advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.353840 permissions required · vdb entry