CVE-2026-4963 is a medium severity (CVSS 6.3) code injection in Hugging Face smolagents 1.25.0.dev0. The record says the local Python executor still has gaps after the earlier fix for CVE-2025-9959. No fixed version is named, so run agent code in a real sandbox and watch the project.
What's affected
- Product: Hugging Face smolagents, version 1.25.0.dev0 per the record.
- Component:
src/smolagents/local_python_executor.py, in the evaluate_augassign, evaluate_call and evaluate_with functions. - Fixed version: none stated in the record. The record says the vendor was contacted and did not respond. Check the project's releases and advisories.
- Weaknesses: CWE-74, injection, and CWE-94, code injection.
- CVSS 6.3 (medium), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L. User interaction is needed. - Published 27 March 2026. Not marked as exploited in CISA KEV. The record says a public write-up exists.
How to check if you're exposed
Check whether and how you use the local executor.
pip show smolagents | grep -i '^version'
grep -R "LocalPythonExecutor\|local_python_executor" --include=*.py .
The local executor runs model-written Python inside a restricted interpreter in your own process. If your agents use it with input that outsiders can influence, you are in the group this CVE is about. If you use a remote or container-based executor, the local executor weaknesses do not apply in the same way.
What to do now
- Check the smolagents releases and security advisories for a fix newer than the version in the record.
- Run agent code in an isolated environment such as a container or a separate sandbox service instead of the local executor.
- Give that environment no secrets, no broad network access and a short lifetime.
- Limit which inputs can reach agents that execute code, and require review of actions with side effects.
- Log what the agent executes so you can investigate.
Why it matters
A restricted Python interpreter tries to let a model run code while blocking dangerous operations. That is hard to get right, because Python has many ways to reach things indirectly. The record describes this as an incomplete fix: the earlier CVE was addressed, and further paths in the same executor remained. The classes are CWE-74 and CWE-94.
The safer design is to assume the interpreter can be escaped and to put a boundary around it, such as a container with no credentials.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that matches the packages in a manifest against known CVEs.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is the local executor safe if I trust my prompts?
Not on its own. Prompts can include text from documents and web pages, so treat generated code as untrusted and sandbox it.
Sources
- Researcher write-up (named in the record; not fetched)
- VulDB entry
- Safeguard Gold entry
Last reviewed: 19 October 2026.
