Hugging Face smolagents version 1.25.0.dev0 contains a code injection vulnerability in the evaluate_augassign, evaluate_call, and evaluate_with functions within src/smolagents/local_python_executor.py. This issue is due to an incomplete fix of a previous vulnerability (CVE-2025-9959). The vulnerability can be exploited remotely and public exploit code is available. The vendor has not responded to the disclosure. The CVSS score is 6.3, indicating a medium severity risk.