The vulnerability of the search_item_ctrl_f() function in the src/smolagents/vision_web_browser.py file of the Hugging Face Smolagents autonomous AI agent framework allows a intruder to gain unauthorized access to protected information.

The vulnerability of the searchitemctrlf function in the src/smolagents/visionwebbrowser.py file of the Hugging Face Smolagents framework is related to insufficient validation of entered data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized...

CVE-2025-11844

Hugging Face Smolagents 1.20.0 has an XPath injection in search_item_ctrl_f (vision_web_browser.py) where user input is concatenated into XPath queries without sanitization, allowing attackers to modify query logic, bypass filters, and access unintended DOM elements, potentially disrupting AI web...