EUVD-2026-25292
GHSA-f7vj-73pm-m822
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconReach exposed LeRobot gRPC port
-
DeliveryCraft malicious pickle payload
-
ExploitSend via SendObservations/SendPolicyInstructions/GetActions
-
InstallServer calls pickle.loads()
-
C2__reduce__ gadget executes
-
ExecuteArbitrary code runs as service
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target be running LeRobot's async inference pipeline (PolicyServer or RobotClient) with its gRPC endpoint network-reachable to the attacker; this is the default communication mode of that subsystem and ships without authentication or TLS, so no credentials, user interaction, or special configuration toggle is needed beyond the endpoint being exposed. The concrete trigger is any of the SendPolicyInstructions, SendObservations, or GetActions gRPC calls carrying a crafted pickle payload. The principal limiting factor is deployment exposure rather than access controls: LeRobot must actually be running the async inference server and its gRPC port must be reachable (LAN, research testbed, or misconfigured internet exposure). Where the port is bound to loopback or firewalled to a trusted peer, remote exploitation is prevented. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, base 9.3) and the source diff are mutually consistent: unauthenticated, low-complexity, network-reachable pickle deserialization yielding full confidentiality, integrity, and availability loss. SSVC reinforces this - Exploitation:poc, Automatable:yes, Technical Impact:total - meaning a reliable, scriptable RCE primitive. The one dissonant signal is EPSS at 0.06% (19th percentile), which appears low relative to a 9.3 unauthenticated RCE with public POC; this most likely reflects LeRobot's limited deployment footprint and sparse exploitation telemetry rather than any barrier to exploitation, so EPSS should not be read as low real risk here. This is not KEV-listed, so exploitation is proven-possible (POC) but not confirmed in the wild. For anyone actually running LeRobot's async inference over an exposed gRPC port, this is a genuine top-priority issue; for the broader population the risk is bounded by how rarely that deployment mode is internet-exposed. |
| Exploit ScenarioDerived | An attacker who can reach the LeRobot PolicyServer's gRPC port on a research network or exposed host sends a crafted SendPolicyInstructions (or SendObservations) request whose byte payload is a malicious pickle stream; when the server calls pickle.loads() the embedded __reduce__ gadget runs attacker code as the server process. The same primitive works in reverse against a RobotClient via the GetActions response path. A public proof-of-concept and technical write-up (chocapikk.com) demonstrate the technique, and the low attack complexity (AC:L) with no required privileges or user interaction makes it readily automatable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Unauthenticated remote code execution in HuggingFace LeRobot (versions 0 through 0.5.1) stems from pickle.loads() being called on attacker-controlled bytes received over the async inference gRPC pipeline, which runs without authentication or TLS. Any network-reachable attacker can execute arbitrary code on either the policy server or the robot client by delivering a malicious pickle payload through the SendPolicyInstructions, SendObservations, or GetActions RPCs. Publicly available exploit code exists (chocapikk write-up) and SSVC rates technical impact as total and the flaw as automatable, though EPSS remains very low (0.06%) reflecting limited real-world telemetry rather than low technical severity.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - apply the changes from https://github.com/huggingface/lerobot/pull/3048, which replace all pickle.loads/pickle.dumps calls in the async inference pipeline with the safetensors+JSON safe_serialization module, and upgrade to any release built after that merge (a specific tagged version above 0.5.1 could not be confirmed from the provided data, so verify the fixed tag against the LeRobot release notes before pinning). Until you can deploy the fixed code, do not expose the async inference gRPC ports to untrusted networks: bind the PolicyServer/RobotClient to loopback or a private management segment and firewall the gRPC port so only the intended peer can reach it (trade-off: precludes remote/distributed inference deployments). Because the channel is unauthenticated and plaintext, front it with mutual-TLS or a network-level authenticated tunnel (e.g., WireGuard/mTLS proxy) so unknown peers cannot deliver payloads (trade-off: added latency and configuration overhead). Avoid running the async inference server on any host reachable from the internet. Reference advisories: the VulnCheck advisory above and the technical write-up at https://chocapikk.com/posts/2026/lerobot-pickle-rce/.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
LeRobot is HuggingFace's open-source robotics/embodied-AI framework; the affected component is its async inference subsystem, which splits work between a PolicyServer (runs the ML policy) and a RobotClient (runs on the robot), communicating over gRPC. The root cause is CWE-502 (Deserialization of Untrusted Data): both endpoints used Python's pickle.dumps/pickle.loads to marshal RemotePolicyConfig, TimedObservation, and TimedAction objects across the wire. Because pickle deserialization can instantiate arbitrary objects and invoke __reduce__ during unpickling, feeding it untrusted bytes is equivalent to arbitrary code execution. The fix (PR #3048) removes pickle entirely and introduces a safe_serialization module using safetensors for tensors and length-prefixed JSON for scalar metadata, with an explicit type-tag check on decode. CPE cpe:2.3:a:huggingface:lerobot:*:*:*:*:*:python:*:* confirms the Python package as the affected artifact.
Know when Lerobot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unauthenticated, low-complexity pickle deserialization over an open gRPC channel yields full code execution, so AV:N/AC:L/PR:N/UI:N with complete C/I/A impact; scope unchanged as the compromised process is the target.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
LeRobot contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads() is used to deserialize data received over unauthenticated gRPC channels without TLS in the policy server and robot client components. An unauthenticated network-reachable attacker can achieve arbitrary code execution on the server or client by sending a crafted pickle payload through the SendPolicyInstructions, SendObservations, or GetActions gRPC calls.
Executive ViewAI
HuggingFace LeRobot (versions 0-0.5.1) contains a critical remote code execution vulnerability that allows any network-reachable attacker to take control of deployed robotics and automation systems without authentication. Organizations using LeRobot for autonomous operations face immediate risk of system compromise and operational disruption; publicly available exploit code reduces the barrier to attack.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict gRPC endpoint network access to internal clients only via firewall rules and VPC segmentation; (2) Implement mutual TLS authentication to add an authentication layer; (3) Monitor for suspicious network activity and deserialization patterns on the inference pipeline; (4) Maintain isolated deployment environments to contain any successful exploitation; (5) Prepare incident response procedures for rapid system isolation if compromise is detected. These controls mitigate but do not eliminate the vulnerability and must be treated as temporary measures pending vendor patch deployment.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB