A vulnerability has been found in huggingface smolagents 1.25.0.dev0 and classified as critical. This affects the function
evaluate_augassign/evaluate_call/evaluate_with of the file src/smolagents/local_python_executor.py of the component Incomplete Fix CVE-2025-9959. This manipulation causes code injection.
The identification of this vulnerability is CVE-2026-4963. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.
The vendor was contacted early about this disclosure but did not respond in any way.
