Lerobot
Monthly
Unauthenticated remote code execution in HuggingFace LeRobot (versions 0 through 0.5.1) stems from pickle.loads() being called on attacker-controlled bytes received over the async inference gRPC pipeline, which runs without authentication or TLS. Any network-reachable attacker can execute arbitrary code on either the policy server or the robot client by delivering a malicious pickle payload through the SendPolicyInstructions, SendObservations, or GetActions RPCs. Publicly available exploit code exists (chocapikk write-up) and SSVC rates technical impact as total and the flaw as automatable, though EPSS remains very low (0.06%) reflecting limited real-world telemetry rather than low technical severity.
The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the from_pretrained() method and related paths. When loading a policy's processor configuration from a repository, the library uses the class field within the JSON configuration to dynamically resolve and instantiate Python classes using importlib.import_module() and getattr().
Unauthenticated remote code execution in HuggingFace LeRobot (versions 0 through 0.5.1) stems from pickle.loads() being called on attacker-controlled bytes received over the async inference gRPC pipeline, which runs without authentication or TLS. Any network-reachable attacker can execute arbitrary code on either the policy server or the robot client by delivering a malicious pickle payload through the SendPolicyInstructions, SendObservations, or GetActions RPCs. Publicly available exploit code exists (chocapikk write-up) and SSVC rates technical impact as total and the flaw as automatable, though EPSS remains very low (0.06%) reflecting limited real-world telemetry rather than low technical severity.
The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the from_pretrained() method and related paths. When loading a policy's processor configuration from a repository, the library uses the class field within the JSON configuration to dynamically resolve and instantiate Python classes using importlib.import_module() and getattr().