Hugging Face smolagents LocalPythonExecutor SSRF Vulnerability Analysis

Key Information Affected Products Product: smolagents Vendor: Hugging Face Vulnerable Component: LocalPythonExecutor Affected Versions V1.x Vulnerability Type SSRF (Server-Side Request Forgery) - CWE-918 Information Exposure (Data Exfiltration) Root Cause The vulnerability resides in the LocalPythonExecutor component. While the executor employs AST-based filtering to block dangerous system calls (RCE), it lacks outbound filtering for authorized network functionality modules. If developers grant access to modules like via the parameter, the executor cannot validate or restrict target URLs. Attackers can exploit this to bypass the sandbox’s logical isolation, accessing internal services or cloud metadata. Impact Cloud Credential Theft: Attackers can access cloud metadata services (e.g., 169.254.169.254) to steal temporary IAM role credentials, leading to full compromise of the cloud environment. Internal Network Probing: The agent acts as a pivot, allowing attackers to access unauthenticated internal services behind firewalls. OOB Data Exfiltration: Even if execution logs are isolated, attackers can exfiltrate sensitive data via chained HTTP requests and Out-of-Band (OOB) techniques. Description During a security audit of Hugging Face’s smolagents library, I discovered a critical SSRF vulnerability in its LocalPythonExecutor. The sandbox’s trust model for authorized imports is insufficient. When the library is enabled, attackers can induce the agent (via Prompt Injection or direct code execution) to probe internal network resources. Additionally, even if the module is restricted, attackers can bypass the sandbox for data exfiltration using built-in Python methods (e.g., , ). This poses a severe threat to privacy and infrastructure security. Authentication Requirements Exploitation depends on application implementation. If the agent is exposed via an unauthenticated API, triggering SSRF requires no login. Vulnerability Details and PoC Vulnerability Location: The parameter during LocalPythonExecutor initialization. Payload: Sample code demonstrates blind SSRF exploitation for code agents and chat agents, including SSRF and OOB data exfiltration. Recommended Remediation 1. Implement Network Egress Filtering: Introduce a default blocklist in LocalPythonExecutor to prevent requests to private IP ranges, loopback addresses, and cloud metadata service IPs. 2. Mandatory URL Validation: Provide a callback mechanism to sanitize and validate all URLs before any network request is sent. 3. Secure-by-Default Examples: Ensure all provided server examples include robust authentication mechanisms to prevent unauthorized agent invocation. 4. Principle of Least Privilege: Clearly warn in documentation about the security implications of authorizing network-capable modules (e.g., or ).

Goal Reached Thanks to every supporter — we hit 100%!

Hugging Face smolagents LocalPythonExecutor SSRF Vulnerability Analysis

More from this source