Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A weakness has been identified in huggingface smolagents 1.24.0. Impacted is the function requests.get/requests.post of the component LocalPythonExecutor. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-2654 A weakness has been identified in huggingface smolagents 1.24.0. Impacted is the function requests.get/requests.post of the component LocalPythonExecutor. Executing a m… https://www.cve.org/CVERecord?id=CVE-2026-2654
Post summary
The text announces CVE‑2026‑2654 as a weakness in huggingface smolagents 1.24.0, detailing the affected functions and component, but does not provide exploit, PoC, or patch information.
@RaxeAi Labs published RAXE-2026-031 on CVE-2026-2654: a config-dependent SSRF in @huggingface smolagents `LocalPythonExecutor`. Impact: internal service access, cloud metadata exposure, and possible credential/data exfiltration when network imports are enabled with no public fix identified at review time. https://www.raxe.ai/labs/advisories/RAXE-2026-031
Post summary
RaxeAi Labs published an advisory for CVE‑2026‑2654, detailing a configuration‑dependent SSRF in HuggingFace’s smolagents LocalPythonExecutor that could expose internal services and cloud metadata, with no fix available yet.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | huggingface | smolagents | - | - | - |