PyPI/smolagents CVE-2026-2654: medium 6.3, EPSS 0.62%
Hugging Face Smolagents has a Server-Side Request Forgery issue
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 1.24.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-jxgv-6j54-wwc7
- https://nvd.nist.gov/vuln/detail/CVE-2026-2654
- https://github.com/CH0ico/CVE_choco_smolagent/blob/main/report.md#proof-of-concept-execution
- https://github.com/CH0ico/CVE_choco_smolagent/tree/main
- https://github.com/huggingface/smolagents
- https://vuldb.com/?ctiid.346451
- https://vuldb.com/?id.346451
- https://vuldb.com/?submit.752774
CVE-2026-2654 · published · modified · JSON