Database/AI/ML frameworks & serving
Hugging Face smolagents: unauthenticated pickle deserialization in the remote Python executor gives RCE
Impact
The remote Python executor path in smolagents unpickles data it receives without validating it, so anyone who can reach the executor endpoint runs arbitrary code as the service account - no credentials needed. On a GPU fleet this is the agent sandbox itself: the executor normally sits next to the model endpoints and holds the tokens and mounts the agent needs, so code execution there inherits inference API keys, object-store credentials and whatever the pod can reach on the cluster network. ZDI scored it 10.0 because the attacker needs nothing but network reach. If the executor pod runs with GPU device access, the attacker also lands on a node that other tenants' work may share.
Who can reach it
Anyone who can open a network connection to the smolagents remote Python executor service. No authentication required, no user interaction.
What to do
Upgrade smolagents to a version containing the fix - the ZDI advisory does not name a fixed release, so check the upstream project before scheduling. Until then, do not expose the remote executor beyond localhost or a tightly scoped NetworkPolicy, and treat it as an untrusted workload: no shared service-account tokens, no cluster-wide secrets mounted. Rollout is a pod/daemon restart of the agent service; no node drain or reboot.
References
Related entries
- MLflow (`extract_archive_to_dir`): Path traversal in the dbconnect artifact cacheCVE-2025-15036 · MLflow (`extract_archive_to_dir`)Critical
- vLLM (Mooncake ZMQ/TCP): Unsafe deserialization exposed on all interfacesCVE-2025-32444 · vLLM (Mooncake ZMQ/TCP)Critical
- Mercury: blocklist typo exposes Jupyter terminal API to unauthenticated shell accessCVE-2026-111057 · Mercury (mljar) anonymous endpoint blocklistCritical
- Crawl4AI: /crawl hooks parameter runs attacker Python through exec(), giving unauthenticated RCECVE-2026-26216 · Crawl4AI Docker API (/crawl hooks parameter)Critical
- ChromaDB: Pre-authentication code injectionCVE-2026-45829 · ChromaDBCritical
- Kubeflow Pipelines frontend: unauthenticated SSRF proxy reaches cloud metadata and cluster-internal APIsCVE-2026-54745 · Kubeflow Pipelines frontend (/_proxy/ route in proxy-middleware.ts)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.