{"action":"Upgrade smolagents to 1.22.0 or later.","affected":[{"fixed":"1.22.0","introduced":"0"}],"component":"smolagents","cve_ids":["CVE-2025-11844"],"ecosystem":"PyPI","epss":0.0028,"exploited":false,"fixed_versions":["1.22.0"],"ghsa_id":"GHSA-8mf9-rmgw-33qc","id":"tcs_01M5KF8K69B50NTC15TFRV0JA4","modified_at":"2026-07-07T17:56:39.648577888Z","published_at":"2025-10-22T15:31:11Z","references":["https://osv.dev/vulnerability/GHSA-8mf9-rmgw-33qc","https://nvd.nist.gov/vuln/detail/CVE-2025-11844","https://github.com/huggingface/smolagents/commit/f570ed5e17999d4cf7d5e79c2830fbaefab8a794","https://github.com/huggingface/smolagents","https://huntr.com/bounties/01ab4405-9bca-4b26-b7a3-5ca1863a69b4"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-8mf9-rmgw-33qc","url":"https://osv.dev/vulnerability/GHSA-8mf9-rmgw-33qc"}],"summary":"Hugging Face Smolagents XPath injection vulnerability in the search_item_ctrl_f function"}