Skip to main content

Lerobot

1 CVEs product

Monthly

CVE-2026-25874 Apr 23, 20:16 CRITICAL Act Now

Unauthenticated remote code execution in HuggingFace LeRobot (versions 0 through 0.5.1) stems from pickle.loads() being called on attacker-controlled bytes received over the async inference gRPC pipeline, which runs without authentication or TLS. Any network-reachable attacker can execute arbitrary code on either the policy server or the robot client by delivering a malicious pickle payload through the SendPolicyInstructions, SendObservations, or GetActions RPCs. Publicly available exploit code exists (chocapikk write-up) and SSVC rates technical impact as total and the flaw as automatable, though EPSS remains very low (0.06%) reflecting limited real-world telemetry rather than low technical severity.

RCE Deserialization Hugging Face Lerobot
NVD GitHub VulDB
CVSS 4.0
9.3
EPSS
0.1%
EPSS 0% CVSS 9.3
CRITICAL Act Now

Unauthenticated remote code execution in HuggingFace LeRobot (versions 0 through 0.5.1) stems from pickle.loads() being called on attacker-controlled bytes received over the async inference gRPC pipeline, which runs without authentication or TLS. Any network-reachable attacker can execute arbitrary code on either the policy server or the robot client by delivering a malicious pickle payload through the SendPolicyInstructions, SendObservations, or GetActions RPCs. Publicly available exploit code exists (chocapikk write-up) and SSVC rates technical impact as total and the flaw as automatable, though EPSS remains very low (0.06%) reflecting limited real-world telemetry rather than low technical severity.

RCE Deserialization Hugging Face +1
NVD GitHub VulDB

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy