Downloads · 30 days
0
ryansecuritytest-fanpierlabs/poc-smolagents-path-traversal-rce
poc-smolagents-path-traversal-rce is a machine learning model from ryansecuritytest-fanpierlabs. Use it for the machine learning task on the model card, and read the license before you ship it in a product. It is set up for smolagents.
Tool names in agent.json are not validated. ../ in tool names reads and exec()s files outside the tools/ directory.
Downloads · 30 days
0
Access
Public
Updated Apr 3, 2026
Repo size
—
Likes
0
Public
Click a slice to open those files.
.py2.3 KB · 55%
From the Hugging Face model README
Tool names in agent.json are not validated. ../ in tool names reads and
exec()s files outside the tools/ directory.
Affected: smolagents/agents.py:1133-1135
# agent.json: {"tools": ["../evil"]}
# Reads: folder/tools/../evil.py = folder/evil.py (outside tools/)
# Then: exec(evil_code) → RCE