CVE-2025-11844: 
Python vulnerability analysis and mitigation

CVE-2025-11844 is an XPath injection vulnerability in Hugging Face Smolagents affecting the search_item_ctrl_f function in src/smolagents/vision_web_browser.py. The function directly concatenates user-supplied input into XPath expressions without sanitization, allowing attackers to manipulate query logic. Affected versions are 1.20.0 through 1.21.x; the issue is fixed in version 1.22.0. It carries a CVSS v3 base score of 5.4 (Moderate), published on October 22, 2025 (Github Advisory, Feedly).

The root cause is CWE-643 (Improper Neutralization of Data within XPath Expressions), where the search_item_ctrl_f function constructs an XPath query using Python f-string interpolation: driver.find_elements(By.XPATH, f"//\*[contains(text(), '{text}')]") — directly embedding unsanitized user input. An attacker who can influence the text parameter (e.g., via a crafted web page or AI agent task input) can inject XPath syntax such as ') or 1=1 or (' to alter query logic, access unintended DOM elements, or chain additional XPath predicates. The fix introduces a _escape_xpath_string() helper that wraps input in single or double quotes, or uses XPath concat() for strings containing both quote types (Github Commit, Github Advisory).

Successful exploitation can lead to information disclosure by exposing unintended DOM elements, manipulation of AI agent interactions within automated web workflows, and disruption of web automation tasks. Because Smolagents is used to build AI agents that interact with web browsers programmatically, injection attacks can cause agents to retrieve or act on unintended data, potentially leaking sensitive page content or causing incorrect automated actions. Availability is not directly impacted, but integrity and confidentiality are both rated as low-impact per the CVSS assessment (Github Advisory, Feedly).

A proof-of-concept exploit is publicly available via the Huntr bug bounty platform, and the vulnerability was reported through that program (Huntr Bounty). There is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.031% (0.000310), placing it in the 16th percentile for exploitation likelihood. The vulnerability requires user interaction (UI:R) — specifically, a user or AI agent must invoke the search_item_ctrl_f function with attacker-controlled input — and no privileges are required. It is not listed in the CISA KEV catalog (Github Advisory, Feedly).

1. Identify target: Locate an environment running Hugging Face Smolagents versions 1.20.0–1.21.x with the vision_web_browser module active (used for AI-driven browser automation tasks).
2. Craft malicious input: Prepare a string containing XPath injection syntax, such as ') or 1=1 or (' or ')] | //user[contains(@role,'admin')] | foo[contains(text(), ', designed to break out of the intended XPath string context.
3. Deliver payload: Cause the AI agent to invoke search_item_ctrl_f with the malicious string as the text parameter — this could be achieved by embedding the payload in a web page the agent is browsing, or by directly supplying it as a task instruction if the agent accepts user-defined search queries.
4. Exploit injected XPath: The unsanitized input is concatenated into //\*[contains(text(), '{text}')], altering the XPath query logic to match unintended DOM elements (e.g., all elements via or 1=1, or specific privileged elements).
5. Exfiltrate or manipulate: The agent processes the unintended DOM elements returned by the manipulated query, potentially exposing sensitive page content or causing the agent to take incorrect automated actions based on the manipulated results (Huntr Bounty, Github Commit).

• Logs: Application or agent logs showing search_item_ctrl_f calls with inputs containing XPath metacharacters such as single quotes ('), pipe characters (|), or 1=1, //, @role, or concat( patterns.
• Network: Unexpected or anomalous data returned from Selenium WebDriver find_elements calls; outbound requests from the agent to unintended URLs triggered by manipulated DOM traversal.
• Process/Behavior: AI agent returning unexpected search results or acting on DOM elements inconsistent with the intended search query; agent workflows producing errors or accessing page sections not related to the search term.

Upgrade Hugging Face Smolagents to version 1.22.0 or later, which introduces the _escape_xpath_string() helper function to properly escape user input before XPath query construction (Github Advisory, Github Commit). As a workaround prior to patching, restrict or validate inputs passed to search_item_ctrl_f to alphanumeric characters only, or avoid using the vision_web_browser module with untrusted input. Using parameterized XPath queries and applying the principle of least privilege to agent permissions are recommended defense-in-depth measures.