Incomplete validation of dunder attributes allows an attacker to escape from the Local Python execution environment sandbox, enforced by smolagents.
Date: 2025-09
Attack vector: prompt-injection
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2025-9959
CWE: CWE-94
CVSS: 7.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L)

Incomplete validation of dunder attributes allows an attacker to escape from the Local Python execution environment sandbox, enforced by smolagents. The attack requires a Prompt Injection in order to trick the agent to create malicious code.


Mitigations:

Architectural layers (MAESTRO):