What is CVE-2025-14931?

CVE-2025-14931 is a critical-severity vulnerability in Hugging Face Smolagents, classified under Deserialization of Untrusted Data. CVSS score: 10.0/10. Published 2025-12-23.

How severe is CVE-2025-14931?

Critical severity. CVSS v3 base score is 10.0 out of 10.

Deserialization in Hugging Face Smolagents

CVE-2025-14931

Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face smolagents…

Vulnerability class: Insecure Deserialization

EPSS: 0.008 (52.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Affected products

Hugging Face Smolagents — versions 1.22.0

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

References

zdi-disclosures@trendmicro.com (x_research-advisory)

Frequently asked questions

What is CVE-2025-14931?: CVE-2025-14931 is a critical-severity vulnerability in Hugging Face Smolagents, classified under Deserialization of Untrusted Data. CVSS score: 10.0/10. Published 2025-12-23.
How severe is CVE-2025-14931?: Critical severity. CVSS v3 base score is 10.0 out of 10.