CVE-2025-5120

CVE-2025-5120 is a sandbox escape (CWE-94) in Hugging Face's smolagents Python agent framework, identified in version 1.14.0, that lets an attacker break out of the restricted code-execution environment and achieve remote code execution on the host. It is triggered when untrusted code — typically model-generated Python executed through the local_python_executor.py module — abuses whitelisted modules and functions that the module's static and dynamic checks fail to adequately restrict. A successful attacker gains arbitrary code execution on the system running the agent, enabling data theft, compromise of integrations reachable from that host, and undermining of the sandbox boundary (reflected in the CVSS scope-changed, 10.0 critical score). Any smolagents deployment running versions from 1.14.0 up to (but not including) the 1.17.0 fix that executes untrusted or model-generated code with the local Python executor is affected. No in-the-wild exploitation is confirmed and the issue is not in CISA KEV, but a public PoC/write-up exists and the high EPSS score (22.8% in 30 days, 98th percentile) indicates meaningful near-term exploitation risk.

What to do: Upgrade to smolagents 1.17.0 or later. Until patched, run any agent workload that executes untrusted or model-generated Python via local_python_executor.py inside an isolated container/VM with restricted filesystem and network access, and audit which whitelisted modules those deployments allow. Check whether executor hosts hold credentials, API keys, or data connections that would be reachable if the sandbox is escaped.