Dashboard / CVE-2026-4963

CVE-2026-4963

LOW
INFO Priority: 0.01 BB Relevance: 54/100
Published: 2026-03-27 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Passive
S: X
AT: None
VC: Low
VI: Low
VA: Low

Description

A weakness has been identified in huggingface smolagents 1.25.0.dev0. This affects the function evaluate_augassign/evaluate_call/evaluate_with of the file src/smolagents/local_python_executor.py of the component Incomplete Fix CVE-2025-9959. This manipulation causes code injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Weakness Classification (2)

Affected Software (1)

VendorProductVersion
huggingface smolagents 1.25.0

References & Advisories (7)

https://vuldb.com/?id.353840
Third Party Advisory VDB Entry
https://vuldb.com/?ctiid.353840
Permissions Required VDB Entry
https://vuldb.com/?submit.777623
Exploit Third Party Advisory VDB Entry
https://vuldb.com/?submit.777643
Exploit Third Party Advisory VDB Entry
https://vuldb.com/?submit.777644
Exploit Third Party Advisory VDB Entry

Bug Bounty Relevance

54 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

2.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.59%
Raw Score 0.005860
Percentile 47.9%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00586
2026-10-28
0.00586

Intelligence Sources

nvd ref →

External Links