A vulnerability was found in huggingface smolagents 1.24.0. It has been declared as critical. Impacted is the function
requests.get/requests.post of the component LocalPythonExecutor. Executing a manipulation can lead to server-side request forgery.
This vulnerability is registered as CVE-2026-2654. It is possible to launch the attack remotely. Furthermore, an exploit is available.
The vendor was contacted early about this disclosure but did not respond in any way.
