7.6

CVSS Score

3.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-5120

CVE-2025-5120: smolagents has Sandbox Escape Vulnerability in the local_python_executor.py Module

A sandbox escape vulnerability was identified in huggingface/smolagents version 1.14.0, allowing attackers to bypass the restricted execution environment and achieve remote code execution (RCE). The vulnerability stems from the local_python_executor.py module, which inadequately restricts Python code execution despite employing static and dynamic checks. Attackers can exploit whitelisted modules and functions to execute arbitrary code, compromising the host system. This flaw undermines the core security boundary intended to isolate untrusted code, posing risks such as unauthorized code execution, data leakage, and potential integration-level compromise. The issue is resolved in version 1.17.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-5120

CVE-2025-5120:

7.6

CVSS Score

3.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
smolagents	pip	< 1.17.0	1.17.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a sandbox escape within the local_python_executor.py module of smolagents. The core issue was that the executor did not properly secure the usage of built-in functions provided as tools within the sandboxed environment. The analysis of the patch commit 33a942e62b6fbf6a35d41f1c735bda2d64c163d0 highlighted two main points of failure.

First, the evaluate_name function would return powerful, unwrapped functions like getattr directly to the evaluation engine. An attacker could then call this function to access attributes of allowed modules that should have been restricted, such as the sys submodule of the warnings module. The fix involves wrapping this function call in a new safer_func decorator that validates the result of the function call, preventing the leakage of unauthorized modules or functions.

Second, the existing security mechanism, the safer_eval decorator, was insufficient. It only validated the final outcome of an entire expression's evaluation. It was blind to intermediate operations, such as a call to getattr inside a map function. An attacker could craft an expression whose final result was safe (e.g., a list), but which performed malicious operations internally. The patch completely removes this flawed decorator and replaces it with the more granular and secure safer_func wrapper applied directly where the dangerous functions are retrieved.

Therefore, any runtime profile during exploitation would feature evaluate_name as it processes the malicious code and retrieves the unwrapped tool function. The now-removed safer_eval represents the inadequate security control that failed to prevent the exploit.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.