CVE-2025-14931: (0Day) Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution Vulnerability
Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face smolagents. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the parsing of pickle data. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28312.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14931?
CVE-2025-14931 is rated as critical due to its potential for remote code execution without authentication.
How do I fix CVE-2025-14931?
To fix CVE-2025-14931, upgrade to the latest patched version of Hugging Face smolagents as released by the vendor.
What systems are affected by CVE-2025-14931?
CVE-2025-14931 affects installations of Hugging Face smolagents that are vulnerable to remote code execution.
Can CVE-2025-14931 be exploited without authentication?
Yes, CVE-2025-14931 can be exploited without authentication by remote attackers.
What type of vulnerability is CVE-2025-14931?
CVE-2025-14931 is a remote code execution vulnerability caused by deserialization of untrusted data.