Threats tagged 'ghsa-q9r5-6hrr-9ph7'

Hugging Face smolagents versions up to 1.23.0 contain a critical remote code execution vulnerability due to unsafe deserialization of untrusted pickle data in the Remote Python Executor component. This flaw allows unauthenticated remote attackers to execute arbitrary code with the privileges of the service account.