Reachy Mini
Monthly
Unauthenticated code installation on the Reachy Mini robot daemon (Pollen Robotics) allows any host on the same LAN to execute arbitrary Python code on the robot by posting an attacker-controlled Hugging Face Space to POST /apps/install. The endpoint is reachable without credentials because the wireless variant of the daemon binds to 0.0.0.0, and the handler's dependency chain (Depends(get_app_manager)) never performs an authorization check; the chosen Space's build/setup code is then executed by the daemon via uv or pip. Affected are all Reachy Mini units before the vendor's v1.11.0 patched release (CPE cpe:2.3:a:pollen_robotics:reachy_mini:*); there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), though the attacker prerequisites are trivial for anyone sharing the robot's Wi-Fi network. Scoring is AV:A/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact, consistent with full compromise of the robot host.
Any Bluetooth device within radio range of a Reachy Mini robot can send CMD_ commands by piggybacking on another operator's completed PIN authentication, because the Bluetooth service keeps its authenticated state in a single shared flag on the service instance rather than binding it to the calling device - the WriteValue handler ignores the BlueZ options argument that carries the caller's identity. The CVSS 3.1 vector AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (6.3, Medium) reflects that Bluetooth proximity and a genuine user completing the PIN exchange are both required, and that standalone impact is limited to command access; root code execution only follows from chaining with CVE-2026-55419 (unrestricted file upload) and CVE-2026-62661 (path traversal in the Bluetooth command handler). No CISA KEV listing, no EPSS score, and no independently published standalone exploit code were identified at time of analysis - the only public documentation is JFrog's description of this as the second step in a three-step attack chain, with no public exploit identified at time of analysis for this issue alone.
Unrestricted file upload in the Reachy Mini daemon (pip/reachy-mini prior to 1.8.2) permits any unauthenticated network-reachable attacker to write arbitrary files to the robot's filesystem at /tmp/reachy_mini_sounds/<filename>. The daemon's /api/media/sounds/upload endpoint applies no authentication, no extension filtering, no content validation, and no size cap, and is bound to 0.0.0.0 with permissive CORS by default, making every network interface the robot touches an attack surface. The GHSA advisory documents this as step 1 of a three-step compromise chain that, when combined with separately reported Bluetooth authentication bypass and directory traversal vulnerabilities, enables full unauthenticated root access on the robot OS; a public proof-of-concept curl command is embedded in the advisory. No CISA KEV listing identified at time of analysis.
Unauthenticated code installation on the Reachy Mini robot daemon (Pollen Robotics) allows any host on the same LAN to execute arbitrary Python code on the robot by posting an attacker-controlled Hugging Face Space to POST /apps/install. The endpoint is reachable without credentials because the wireless variant of the daemon binds to 0.0.0.0, and the handler's dependency chain (Depends(get_app_manager)) never performs an authorization check; the chosen Space's build/setup code is then executed by the daemon via uv or pip. Affected are all Reachy Mini units before the vendor's v1.11.0 patched release (CPE cpe:2.3:a:pollen_robotics:reachy_mini:*); there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), though the attacker prerequisites are trivial for anyone sharing the robot's Wi-Fi network. Scoring is AV:A/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact, consistent with full compromise of the robot host.
Any Bluetooth device within radio range of a Reachy Mini robot can send CMD_ commands by piggybacking on another operator's completed PIN authentication, because the Bluetooth service keeps its authenticated state in a single shared flag on the service instance rather than binding it to the calling device - the WriteValue handler ignores the BlueZ options argument that carries the caller's identity. The CVSS 3.1 vector AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (6.3, Medium) reflects that Bluetooth proximity and a genuine user completing the PIN exchange are both required, and that standalone impact is limited to command access; root code execution only follows from chaining with CVE-2026-55419 (unrestricted file upload) and CVE-2026-62661 (path traversal in the Bluetooth command handler). No CISA KEV listing, no EPSS score, and no independently published standalone exploit code were identified at time of analysis - the only public documentation is JFrog's description of this as the second step in a three-step attack chain, with no public exploit identified at time of analysis for this issue alone.
Unrestricted file upload in the Reachy Mini daemon (pip/reachy-mini prior to 1.8.2) permits any unauthenticated network-reachable attacker to write arbitrary files to the robot's filesystem at /tmp/reachy_mini_sounds/<filename>. The daemon's /api/media/sounds/upload endpoint applies no authentication, no extension filtering, no content validation, and no size cap, and is bound to 0.0.0.0 with permissive CORS by default, making every network interface the robot touches an attack surface. The GHSA advisory documents this as step 1 of a three-step compromise chain that, when combined with separately reported Bluetooth authentication bypass and directory traversal vulnerabilities, enables full unauthenticated root access on the robot OS; a public proof-of-concept curl command is embedded in the advisory. No CISA KEV listing identified at time of analysis.