CVE-2025-11844: smolagents security flaw enables

CISO Take

If your team uses HuggingFace smolagents for any web automation or agentic browsing task, upgrade to v1.22.0 immediately — the fix is one pip install. The risk is not the CVSS score; it is that a malicious webpage can manipulate what your AI agent sees and acts on, turning your automated workflow into an attacker-controlled one. Until patched, restrict agent web access to allowlisted trusted domains.

What is the risk?

Contextual risk exceeds the CVSS 5.4 (medium) for organizations running agentic AI pipelines. The vulnerability requires no privileges and targets a common autonomous browsing pattern — any smolagents deployment that allows agents to browse arbitrary web content is in scope. EPSS of 0.00041 confirms no active mass exploitation, but the attack surface is growing as agentic AI adoption accelerates. The real risk is integrity of agent decisions, not data breach directly.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
smolagents	pip	—	No patch
27.9K 93 dependents Pushed 7d ago 25% patched ~10d to patch Full package profile →
smolagents	pip	< 1.22.0	`1.22.0`
27.9K 93 dependents Pushed 7d ago 25% patched ~10d to patch Full package profile →

How severe is it?

CVSS 3.1

5.4 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 16% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C Low

I Low

A None

What should I do?

1 step

1) Patch: pip install smolagents>=1.22.0 — the fix is available and targeted (commit f570ed5e). 2) If patching is blocked, disable vision_web_browser.py usage or gate it behind domain allowlisting. 3) Add input sanitization at the tool interface layer for any XPath-consuming functions. 4) Instrument agent tool calls with logging to detect anomalous DOM query patterns. 5) Review all custom forks or copies of vision_web_browser.py — the issue is in a specific function that may have been copy-pasted. 6) Cross-check huntr PoC (linked in references) against your deployment to confirm exploitability in your specific configuration.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Extraction Auth Bypass Agent Framework Plugin AML.T0049 - Exploit Public-Facing Application AML.T0051.001 - Indirect AML.T0080 - AI Agent Context Poisoning AML.T0100 - AI Agent Clickbait

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

MS-2.5 - Manage AI risks from third-party entities

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2025-11844?

If your team uses HuggingFace smolagents for any web automation or agentic browsing task, upgrade to v1.22.0 immediately — the fix is one pip install. The risk is not the CVSS score; it is that a malicious webpage can manipulate what your AI agent sees and acts on, turning your automated workflow into an attacker-controlled one. Until patched, restrict agent web access to allowlisted trusted domains.

Is CVE-2025-11844 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-11844, increasing the risk of exploitation.

How to fix CVE-2025-11844?

1) Patch: `pip install smolagents>=1.22.0` — the fix is available and targeted (commit f570ed5e). 2) If patching is blocked, disable vision_web_browser.py usage or gate it behind domain allowlisting. 3) Add input sanitization at the tool interface layer for any XPath-consuming functions. 4) Instrument agent tool calls with logging to detect anomalous DOM query patterns. 5) Review all custom forks or copies of vision_web_browser.py — the issue is in a specific function that may have been copy-pasted. 6) Cross-check huntr PoC (linked in references) against your deployment to confirm exploitability in your specific configuration.

What systems are affected by CVE-2025-11844?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, web automation pipelines, AI browsing agents, multi-step agentic workflows, LLM tool-use integrations.

What is the CVSS score for CVE-2025-11844?

CVE-2025-11844 has a CVSS v3.1 base score of 5.4 (MEDIUM). The EPSS exploitation probability is 0.25%.

What is the AI security impact?

Affected AI Architectures

agent frameworksweb automation pipelinesAI browsing agentsmulti-step agentic workflowsLLM tool-use integrations

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0051.001 Indirect

AML.T0080 AI Agent Context Poisoning

AML.T0100 AI Agent Clickbait

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MS-2.5

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py. The function constructs an XPath query by directly concatenating user-supplied input into the XPath expression without proper sanitization or escaping. This allows an attacker to inject malicious XPath syntax that can alter the intended query logic. The vulnerability enables attackers to bypass search filters, access unintended DOM elements, and disrupt web automation workflows. This can lead to information disclosure, manipulation of AI agent interactions, and compromise the reliability of automated web tasks. The issue is fixed in version 1.22.0.

Exploitation Scenario

An attacker publishes a legitimate-looking webpage (e.g., a fake CVE summary site, a phishing page, or injected content on a compromised site). A smolagents-based agent browsing the web as part of a research or automation workflow calls `search_item_ctrl_f` to locate specific text. The attacker-controlled page contains XPath injection syntax embedded in visible text elements. The unsanitized input alters the XPath query, causing the function to return unintended DOM nodes — leaking hidden form data, bypassing content visibility filters, or feeding the agent incorrect page context. In a multi-step workflow, the agent proceeds to take actions (clicks, data extraction, report generation) based on this manipulated view.

Weaknesses (CWE)

CWE-643 Improper Neutralization of Data within XPath Expressions ('XPath Injection') Primary CWE-643 Improper Neutralization of Data within XPath Expressions ('XPath Injection')

CWE-643 — Improper Neutralization of Data within XPath Expressions ('XPath Injection'): The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.

[Implementation] Use parameterized XPath queries (e.g. using XQuery). This will help ensure separation between data plane and control plane.
[Implementation] Properly validate user input. Reject data where appropriate, filter where appropriate and escape where appropriate. Make sure input that will be used in XPath queries is safe in that context.

Source: MITRE CWE corpus.