CVE-2026-2654

A weakness has been identified in huggingface smolagents 1.24.0. Impacted is the function requests.get/requests.post of the component LocalPythonExecutor. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

An adversary targets an organization's customer-facing AI assistant built on smolagents 1.24.0. They submit a crafted query that causes LocalPythonExecutor to execute Python containing requests.get('http://169.254.169.254/latest/meta-data/iam/security-credentials/my-role'). The metadata service returns temporary AWS IAM credentials. The adversary uses these to authenticate to AWS, enumerate S3 buckets containing training data and customer PII, and pivot to other internal services. Alternatively, an attacker chains this with LLM prompt injection: a malicious document ingested by a RAG pipeline contains instructions that cause the agent LLM to generate the SSRF payload autonomously. The attack generates no IAM authentication events — only network traffic — making detection difficult without egress monitoring.