CVE-2026-2654CWE-918

huggingface smolagents LocalPythonExecutor requests.post server-side request forgery

Medium · published February 18, 2026

CVSS v4.0
5.3
EPSS
1%
Percentile
49.0
In the wild
Unconfirmed
What it is

A weakness has been identified in huggingface smolagents 1.24.0. Impacted is the function requests.get/requests.post of the component LocalPythonExecutor. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00619 · 49.0th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-02-18T13:32Z
EPSS history
Timeline
  • 18 FEB 13:32Z
    huggingface smolagents LocalPythonExecutor requests.post server-side request forgery
    cvelistv5