CVE-2025-5120 is a critical (CVSS 10.0) sandbox escape in Hugging Face smolagents 1.14.0. The local Python executor fails to confine code, which can lead to remote code execution on the host. The record says the issue is resolved in version 1.17.0, so upgrade to that release or later.
What's affected
smolagents version 1.14.0, per the record. The flaw is in local_python_executor.py, the module that runs model generated Python inside a restricted environment. The record says the fix is in 1.17.0.
The record names only 1.14.0 as affected. It does not say whether versions between 1.14.0 and 1.17.0 are vulnerable, so treat everything below 1.17.0 as suspect until you have checked the release notes.
The fix commit linked in the record is titled "Prevent submodules through indirect attribute access in LocalPythonExecutor". That tells you the area of the change: the executor checked what code imported, but code could still reach modules by another route. The commit also adds checks on the values the executor returns, and it changes the tests.
How to check if you're exposed
Check the installed version in every environment where agents run, including notebooks, containers and CI jobs:
pip show smolagents
pip list 2>/dev/null | grep -i smolagents
Find declared dependencies across repositories:
grep -rn "smolagents" requirements*.txt pyproject.toml poetry.lock uv.lock Pipfile.lock 2>/dev/null
Look for where the local executor is used. Agents that run code through a remote or containerised executor are in a different position from agents that use the local one in the same process as your application.
You can also run the free in-browser dependency scan at gold.safeguard.sh/scan, which checks the packages your own projects use against the Gold directory. It will not find a commercial product installed on a server, so pair it with an inventory of what runs where. Reachability analysis helps with libraries, because it asks whether your code actually calls the vulnerable function. For a standalone server product like this one, the question is simpler: is it installed, and can anyone reach it?
What to do now
- Upgrade smolagents to 1.17.0 or later and rebuild images and lock files:
pip install --upgrade "smolagents>=1.17.0"
- Search all repositories, notebooks and base images for older pins and update them.
- Do not rely on the local executor as a security boundary. Run agent generated code in an isolated container or sandbox with no access to credentials and a limited network.
- Remove secrets, tokens and cloud credentials from the environment of any process that runs model generated code.
- If an older version ran against untrusted input, review the host for unexpected processes and rotate any credentials it could read.
Why it matters
The record classifies this as CWE-94 (Code Injection). Code injection here means that code the application meant to restrict can still run with the application's own rights. A restricted interpreter tries to allow harmless operations and block dangerous ones with static checks and run time checks. Python is flexible enough that blocking every route to a dangerous function is very hard, and a gap in one route is enough.
The score is the maximum, 10.0, with a changed scope in the vector. That reflects that code running in the executor can affect resources beyond the executor itself. Agent frameworks make this sharper, because the code to run comes from a language model whose input can include untrusted web pages, documents or messages.
The practical lesson is to treat an in-process sandbox as a convenience, not a fence. The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2025-5120?
Version 1.17.0, per the record. Upgrade to that release or later and check the project's release notes for other changes.
Am I affected if my agent only uses a remote executor?
The record describes the flaw in the local Python executor module. If your agents never call it, your exposure is different, but confirm in your code and keep the library up to date anyway.
Is a restricted Python interpreter enough protection for model written code?
No. Treat it as one layer. Run untrusted or model generated code in an isolated container with no secrets and limited network access.
Sources
- smolagents fix commit listed in the record
- huntr bounty listed in the record
- Gold vulnerability page
Last reviewed: 18 October 2026.
