CVE-2026-2654: huggingface smolagents LocalPythonExecutor requests.post server-side request forgery
A weakness has been identified in huggingface smolagents 1.24.0. Impacted is the function requests.get/requests.post of the component LocalPythonExecutor. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2654?
CVE-2026-2654 has been classified as having a medium severity due to the potential for server-side request forgery.
What software versions are affected by CVE-2026-2654?
CVE-2026-2654 affects versions of huggingface smolagents from 1.0.0 up to, but not including, 1.24.0.
How do I fix CVE-2026-2654?
To fix CVE-2026-2654, update your huggingface smolagents library to version 1.24.0 or higher.
What is the impact of CVE-2026-2654?
The impact of CVE-2026-2654 allows attackers to exploit server-side request forgery vulnerabilities through manipulated requests.
Which component is vulnerable in CVE-2026-2654?
The vulnerable component in CVE-2026-2654 is the function requests.get/requests.post of the LocalPythonExecutor.