CVE-2025-11844: Hugging Face Smolagents XPath injection vulnerability in the search_item_ctrl_f function

The vulnerability analysis identified search_item_ctrl_f in src/smolagents/vision_web_browser.py as the vulnerable function. The root cause is the direct and unsafe concatenation of user-provided input (text) into an XPath query. The evidence from the patch is the removal of the line elements = driver.find_elements(By.XPATH, f"//*[contains(text(), \'{text}\')]"), which clearly shows the insecure construction of the XPath expression. An attacker could supply a crafted string like ') or '1'='1 to manipulate the query. The fix involves adding a sanitization function _escape_xpath_string and using it to clean the input before it is included in the query: escaped_text = _escape_xpath_string(text) and elements = driver.find_elements(By.XPATH, f"//*[contains(text(), {escaped_text})]"). When this vulnerability is triggered, the search_item_ctrl_f function would be present in any runtime profile or stack trace, as it is the entry point for the malicious input and the location of the flawed logic.