{"action":"Upgrade smolagents to 1.22.0 or later.","affected":[{"fixed":"1.22.0","introduced":"0"}],"component":"smolagents","cve_ids":["CVE-2025-11844"],"ecosystem":"PyPI","epss":0.0028,"exploited":false,"fixed_versions":["1.22.0"],"ghsa_id":"GHSA-8mf9-rmgw-33qc","id":"tcs_01M5KGWH64H7W1ZNQ544B030AB","modified_at":"2026-07-07T17:47:54.122036475Z","published_at":"2026-07-07T16:03:07.970456Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1930","https://nvd.nist.gov/vuln/detail/CVE-2025-11844","https://github.com/huggingface/smolagents/commit/f570ed5e17999d4cf7d5e79c2830fbaefab8a794","https://github.com/huggingface/smolagents","https://huntr.com/bounties/01ab4405-9bca-4b26-b7a3-5ca1863a69b4","https://pypi.org/project/smolagents","https://github.com/advisories/GHSA-8mf9-rmgw-33qc"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"PYSEC-2026-1930","url":"https://osv.dev/vulnerability/PYSEC-2026-1930"}],"summary":"Hugging Face Smolagents XPath injection vulnerability in the search_item_ctrl_f function"}