CVE-2025-11844

Name: CVE-2025-11844
Creator: NVD / NIST
Published: 2025-10-22T14:15:49.457+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 0.25%

Last modified Jun 17, 2026

CVE-2025-11844 is a vulnerability of currently unknown severity. Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py. The function constructs an XPath query by directly concatenating user-supplied input into the XPath expression without proper sanitization or escaping. EPSS estimates a 0.25% chance of exploitation in the next 30 days.

Description

Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py. The function constructs an XPath query by directly concatenating user-supplied input into the XPath expression without proper sanitization or escaping. This allows an attacker to inject malicious XPath syntax that can alter the intended query logic. The vulnerability enables attackers to bypass search filters, access unintended DOM elements, and disrupt web automation workflows. This can lead to information disclosure, manipulation of AI agent interactions, and compromise the reliability of automated web tasks. The issue is fixed in version 1.22.0.

Metrics

EPSS Probability

0.25%

16.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-643

Affected Software

Vendor	Product	Versions
Huggingface	Smolagents	>= 1.20.0, < 1.22.0

References

https://github.com/huggingface/smolagents/commit/f570ed5e17999d4cf7d5e79c2830fbaefab8a794Patch
https://huntr.com/bounties/01ab4405-9bca-4b26-b7a3-5ca1863a69b4Exploit, Third Party Advisory
https://huntr.com/bounties/01ab4405-9bca-4b26-b7a3-5ca1863a69b4Exploit, Third Party Advisory

Timeline

Published: Oct 22, 2025
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2025-11844?

How severe is CVE-2025-11844?

Severity scoring for CVE-2025-11844 is pending analysis. The EPSS model estimates a 0.25% probability of exploitation in the next 30 days.

How do I fix CVE-2025-11844?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2025-11844?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST