FKIE_CVE-2025-11844

Vulnerability from fkie_nvd - Published: 2025-10-22 14:15 - Updated: 2026-10-08 11:10
Severity
5.4 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Summary
Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py. The function constructs an XPath query by directly concatenating user-supplied input into the XPath expression without proper sanitization or escaping. This allows an attacker to inject malicious XPath syntax that can alter the intended query logic. The vulnerability enables attackers to bypass search filters, access unintended DOM elements, and disrupt web automation workflows. This can lead to information disclosure, manipulation of AI agent interactions, and compromise the reliability of automated web tasks. The issue is fixed in version 1.22.0.
References
security@huntr.devhttps://github.com/huggingface/smolagents/commit/f570ed5e17999d4cf7d5e79c2830fbaefab8a794Patch
security@huntr.devhttps://huntr.com/bounties/01ab4405-9bca-4b26-b7a3-5ca1863a69b4Exploit, Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0https://huntr.com/bounties/01ab4405-9bca-4b26-b7a3-5ca1863a69b4Exploit, Third Party Advisory
Impacted products
Vendor Product Version
huggingface smolagents *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "huggingface/smolagents",
          "vendor": "huggingface",
          "versions": [
            {
              "lessThan": "1.22.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "security@huntr.dev"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:huggingface:smolagents:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4FBDA817-4B1A-4C1C-B28E-039793EE915C",
              "versionEndExcluding": "1.22.0",
              "versionStartIncluding": "1.20.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py. The function constructs an XPath query by directly concatenating user-supplied input into the XPath expression without proper sanitization or escaping. This allows an attacker to inject malicious XPath syntax that can alter the intended query logic. The vulnerability enables attackers to bypass search filters, access unintended DOM elements, and disrupt web automation workflows. This can lead to information disclosure, manipulation of AI agent interactions, and compromise the reliability of automated web tasks. The issue is fixed in version 1.22.0."
    },
    {
      "lang": "es",
      "value": "Hugging Face Smolagents versi\u00f3n 1.20.0 contiene una vulnerabilidad de inyecci\u00f3n XPath en la funci\u00f3n search_item_ctrl_f ubicada en src/smolagents/vision_web_browser.py. La funci\u00f3n construye una consulta XPath al concatenar directamente la entrada proporcionada por el usuario en la expresi\u00f3n XPath sin una sanitizaci\u00f3n o escape adecuados. Esto permite a un atacante inyectar sintaxis XPath maliciosa que puede alterar la l\u00f3gica de consulta prevista. La vulnerabilidad permite a los atacantes eludir los filtros de b\u00fasqueda, acceder a elementos DOM no deseados y perturbar los flujos de trabajo de automatizaci\u00f3n web. Esto puede conducir a la revelaci\u00f3n de informaci\u00f3n, la manipulaci\u00f3n de las interacciones de los agentes de IA y comprometer la fiabilidad de las tareas web automatizadas. El problema se corrige en la versi\u00f3n 1.22.0."
    }
  ],
  "id": "CVE-2025-11844",
  "lastModified": "2026-10-08T11:10:00.250",
  "metrics": {
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5,
        "source": "security@huntr.dev",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-11844",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-10-22T14:07:23.770923Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-10-22T14:15:49.457",
  "references": [
    {
      "source": "security@huntr.dev",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/huggingface/smolagents/commit/f570ed5e17999d4cf7d5e79c2830fbaefab8a794"
    },
    {
      "source": "security@huntr.dev",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://huntr.com/bounties/01ab4405-9bca-4b26-b7a3-5ca1863a69b4"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://huntr.com/bounties/01ab4405-9bca-4b26-b7a3-5ca1863a69b4"
    }
  ],
  "sourceIdentifier": "security@huntr.dev",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-643"
        }
      ],
      "source": "security@huntr.dev",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.