smolagents 0.1.3 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the smolagents package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Improper Neutralization of Data within XPath Expressions ('XPath Injection') smolagents is a 🤗 smolagents: a barebones library for agents. Agents write python code to call tools or orchestrate other agents. Affected versions of this package are vulnerable to Improper Neutralization of Data within XPath Expressions ('XPath Injection') via the `search_item_ctrl_f()` function due to the lack of user-supplied text escaping. An attacker could find out how the XML data is structured, or access data that they may not have access to. How to fix Improper Neutralization of Data within XPath Expressions ('XPath Injection')? Upgrade `smolagents` to version 1.22.0 or higher.	[,1.22.0)
H Arbitrary Code Injection smolagents is a 🤗 smolagents: a barebones library for agents. Agents write python code to call tools or orchestrate other agents. Affected versions of this package are vulnerable to Arbitrary Code Injection due to incomplete validation of `dunder` attributes, that allows an attacker to escape from the Local Python execution environment sandbox. The attack requires a `Prompt Injection` in order to trick the agent to create malicious code. How to fix Arbitrary Code Injection? Upgrade `smolagents` to version 1.21.0 or higher.	[,1.21.0)
H Arbitrary Code Injection smolagents is a 🤗 smolagents: a barebones library for agents. Agents write python code to call tools or orchestrate other agents. Affected versions of this package are vulnerable to Arbitrary Code Injection via the `evaluate_name` function in the `local_python_executor.py` file. An attacker can execute arbitrary code on the host system by leveraging whitelisted modules and functions to bypass the restricted execution environment. How to fix Arbitrary Code Injection? Upgrade `smolagents` to version 1.17.0 or higher.	[,1.17.0)
H Arbitrary Code Execution smolagents is a 🤗 smolagents: a barebones library for agents. Agents write python code to call tools or orchestrate other agents. Affected versions of this package are vulnerable to Arbitrary Code Execution due to allowing access to Python `builtins` in `local_python_executor.py`, and only restricting `eval()`, `compile()`, and `exec()`. How to fix Arbitrary Code Execution? Upgrade `smolagents` to version 1.5.0 or higher.	[,1.5.0)
H Arbitrary Code Execution smolagents is a 🤗 smolagents: a barebones library for agents. Agents write python code to call tools or orchestrate other agents. Affected versions of this package are vulnerable to Arbitrary Code Execution in the `import_modules()` function, which can import arbitrary built-in modules such as `_os_system`, which can execute code. A malicious LLM containing such imports can execute code when loaded. How to fix Arbitrary Code Execution? Upgrade `smolagents` to version 1.4.0 or higher.	[,1.4.0)

Vulnerability

Vulnerable Version

Improper Neutralization of Data within XPath Expressions ('XPath Injection')