6.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-2654

CVE-2026-2654: Hugging Face Smolagents has a Server-Side Request Forgery issue

A weakness has been identified in huggingface smolagents 1.24.0. Impacted is the function requests.get/requests.post of the component LocalPythonExecutor. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-2654

CVE-2026-2654:

6.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
smolagents	pip	<= 1.24.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the LocalPythonExecutor component of the smolagents library, which is designed to execute Python code in a sandboxed environment. The core issue is a Server-Side Request Forgery (SSRF) weakness, identified as CVE-2026-2654. The vulnerability is not due to a flaw in a single line of code but rather a design weakness in the sandboxing mechanism.

The LocalPythonExecutor allows developers to specify additional Python libraries that the sandboxed code can import via the additional_authorized_imports parameter. If a developer authorizes the requests library, the sandbox does not enforce any egress filtering or validation on the URLs that can be accessed by requests.get or requests.post. This allows an attacker to craft Python code that, when executed by the LocalPythonExecutor, can make arbitrary HTTP requests from the server.

The primary vulnerable function is LocalPythonExecutor.__call__, which is the entry point for executing the user-provided code. This method, in turn, relies on evaluate_python_code and evaluate_call to parse and execute the code. When the code contains a call to requests.get or requests.post, evaluate_call is responsible for invoking the function, but it does so without any security checks on the target URL.

An attacker can exploit this vulnerability to:

Probe the internal network and access services that are not exposed to the public internet.
Access cloud provider metadata services (e.g., AWS EC2 metadata endpoint at 169.254.169.254) to steal temporary credentials and potentially gain control over the cloud environment.
Exfiltrate sensitive data to an attacker-controlled server.

The provided proof-of-concept clearly demonstrates how to use this vulnerability to make a request to an internal IP address and exfiltrate data. Since there is no patched version available, any application using smolagents version 1.24.0 or older is vulnerable if it configures the LocalPythonExecutor to allow the requests library.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.