A server-side request forgery (SSRF) vulnerability exists in Hugging Face smolagents version 1.24.0 and earlier. The flaw affects the LocalPythonExecutor component's use of requests.get and requests.post functions. This vulnerability allows remote attackers with limited privileges to manipulate requests, potentially leading to unauthorized internal network requests. Public exploit code is available, but no vendor response or patch has been provided.