Which versions of LeRobot are affected by CVE-2026-25874?

HuggingFace LeRobot (versions 0-0.5.1) contains a critical remote code execution vulnerability that allows any network-reachable attacker to take control of deployed robotics and automation systems…

How to fix or mitigate CVE-2026-25874?

Immediately within 24 hours identify all HuggingFace LeRobot deployments running versions 0 through 0.5.1 and isolate any that are network-reachable, verifying gRPC endpoints are not accessible from untrusted networks and documenting all current access paths. Within 7 days, implement firewall rules restricting gRPC traffic to known internal clients only, enable mutual TLS on all gRPC communications if supported by your deployed version, and enable detailed audit logging on the inference pipeline to detect deserialization anomalies and suspicious network patterns. Within 30 days, prepare a staging environment for testing the patched version as soon as HuggingFace releases it, and if no vendor update is available within 60 days, begin evaluation of alternative robotics platforms or migrate to isolated network enclaves with incident response procedures to enable rapid containment if exploitation is detected.

LeRobot CVE-2026-25874

Q: What is the CVSS score of CVE-2026-25874?

CVE-2026-25874 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-25292 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-04-23 disclosure@vulncheck.com

GHSA-f7vj-73pm-m822

RCE Deserialization Hugging Face Lerobot

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated, low-complexity pickle deserialization over an open gRPC channel yields full code execution, so AV:N/AC:L/PR:N/UI:N with complete C/I/A impact; scope unchanged as the compromised process is the target.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 03:44 vuln.today

Analysis Generated

Jul 24, 2026 - 03:44 vuln.today

EUVD ID Assigned

Apr 23, 2026 - 20:26 euvd

EUVD-2026-25292

CVE Published

Apr 23, 2026 - 20:16 nvd

CRITICAL 9.3

DescriptionCVE.org

LeRobot contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads() is used to deserialize data received over unauthenticated gRPC channels without TLS in the policy server and robot client components. An unauthenticated network-reachable attacker can achieve arbitrary code execution on the server or client by sending a crafted pickle payload through the SendPolicyInstructions, SendObservations, or GetActions gRPC calls.

AnalysisAI

Unauthenticated remote code execution in HuggingFace LeRobot (versions 0 through 0.5.1) stems from pickle.loads() being called on attacker-controlled bytes received over the async inference gRPC pipeline, which runs without authentication or TLS. Any network-reachable attacker can execute arbitrary code on either the policy server or the robot client by delivering a malicious pickle payload through the SendPolicyInstructions, SendObservations, or GetActions RPCs. Publicly available exploit code exists (chocapikk write-up) and SSVC rates technical impact as total and the flaw as automatable, though EPSS remains very low (0.06%) reflecting limited real-world telemetry rather than low technical severity.

Technical ContextAI

LeRobot is HuggingFace's open-source robotics/embodied-AI framework; the affected component is its async inference subsystem, which splits work between a PolicyServer (runs the ML policy) and a RobotClient (runs on the robot), communicating over gRPC. The root cause is CWE-502 (Deserialization of Untrusted Data): both endpoints used Python's pickle.dumps/pickle.loads to marshal RemotePolicyConfig, TimedObservation, and TimedAction objects across the wire. Because pickle deserialization can instantiate arbitrary objects and invoke __reduce__ during unpickling, feeding it untrusted bytes is equivalent to arbitrary code execution. The fix (PR #3048) removes pickle entirely and introduces a safe_serialization module using safetensors for tensors and length-prefixed JSON for scalar metadata, with an explicit type-tag check on decode. CPE cpe:2.3:a:huggingface:lerobot:*:*:*:*:*:python:*:* confirms the Python package as the affected artifact.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the changes from https://github.com/huggingface/lerobot/pull/3048, which replace all pickle.loads/pickle.dumps calls in the async inference pipeline with the safetensors+JSON safe_serialization module, and upgrade to any release built after that merge (a specific tagged version above 0.5.1 could not be confirmed from the provided data, so verify the fixed tag against the LeRobot release notes before pinning). Until you can deploy the fixed code, do not expose the async inference gRPC ports to untrusted networks: bind the PolicyServer/RobotClient to loopback or a private management segment and firewall the gRPC port so only the intended peer can reach it (trade-off: precludes remote/distributed inference deployments). Because the channel is unauthenticated and plaintext, front it with mutual-TLS or a network-level authenticated tunnel (e.g., WireGuard/mTLS proxy) so unknown peers cannot deliver payloads (trade-off: added latency and configuration overhead). Avoid running the async inference server on any host reachable from the internet. Reference advisories: the VulnCheck advisory above and the technical write-up at https://chocapikk.com/posts/2026/lerobot-pickle-rce/.