Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-115533 (GCVE-0-2026-115533)

Vulnerability from nvd – Published: 2026-10-26 19:38 – Updated: 2026-10-26 19:38

Title

CVE-2026-115533

Summary

The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the from_pretrained() method and related paths. When loading a policy's processor configuration from a repository, the library uses the class field within the JSON configuration to dynamically resolve and instantiate Python classes using importlib.import_module() and getattr().

Severity

No CVSS data available.

CWE

Assigner

certcc CNA under the mitre root

CNA scorecard E 42/100 over 180 records in the last 180 days details

References

1 reference

URL	Tags
https://gist.github.com/mtholmquist/eba1cba80ea66…

Impacted products

1 product

Vendor	Product	Version
Hugging Face	LeRobot	Affected: 0.4.0 , ≤ 0.6.1 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "LeRobot",
          "vendor": "Hugging Face",
          "versions": [
            {
              "lessThanOrEqual": "0.6.1",
              "status": "affected",
              "version": "0.4.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the from_pretrained() method and related paths. When loading a policy\u0027s processor configuration from a repository,  the library uses the class field within the JSON configuration to dynamically resolve and instantiate Python classes using importlib.import_module() and getattr()."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T19:38:54.907Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://gist.github.com/mtholmquist/eba1cba80ea66997b8f7e6a839e49120"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2026-115533",
      "x_generator": {
        "engine": "VINCE 3.0.51",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-115533"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-115533",
    "datePublished": "2026-10-26T19:38:54.907Z",
    "dateReserved": "2026-10-22T19:09:47.515Z",
    "dateUpdated": "2026-10-26T19:38:54.907Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-25874 (GCVE-0-2026-25874)

Vulnerability from nvd – Published: 2026-04-23 19:45 – Updated: 2026-11-09 19:24 X_Open Source

Title

LeRobot Unsafe Deserialization Remote Code Execution via gRPC

Summary

LeRobot through 0.6.1 contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads() is used to deserialize data received over unauthenticated gRPC channels without TLS in the policy server and robot client components. An unauthenticated network-reachable attacker can achieve arbitrary code execution on the server or client by sending a crafted pickle payload through the SendPolicyInstructions, SendObservations, or GetActions gRPC calls.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-24 14:34 UTC

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8197 records in the last 180 days details

References

5 references

URL	Tags
https://chocapikk.com/posts/2026/lerobot-pickle-rce/	exploit
https://github.com/huggingface/lerobot/issues/3047	issue-tracking
https://github.com/huggingface/lerobot/pull/3048	issue-trackingpatch
https://github.com/huggingface/lerobot/issues/3134	issue-tracking
https://www.vulncheck.com/advisories/lerobot-unsa…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
Hugging Face	LeRobot	Affected: 0 , ≤ 0.6.1 (semver) cpe:2.3:a:huggingface:lerobot::::::python::*

Date Public

2026-02-27 00:00

Credits

Valentin Lobstein (Chocapikk)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25874",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-24T14:34:03.307494Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-24T18:20:13.815Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "packageURL": "pkg:pypi/lerobot",
          "product": "LeRobot",
          "repo": "https://github.com/huggingface/lerobot",
          "vendor": "Hugging Face",
          "versions": [
            {
              "lessThanOrEqual": "0.6.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:huggingface:lerobot:*:*:*:*:*:python:*:*",
                  "versionEndIncluding": "0.6.1",
                  "vulnerable": true
                }
              ],
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Valentin Lobstein (Chocapikk)"
        }
      ],
      "datePublic": "2026-02-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "LeRobot through 0.6.1 contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads() is used to deserialize data received over unauthenticated gRPC channels without TLS in the policy server and robot client components. An unauthenticated network-reachable attacker can achieve arbitrary code execution on the server or client by sending a crafted pickle payload through the SendPolicyInstructions, SendObservations, or GetActions gRPC calls."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T19:24:39.218Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://chocapikk.com/posts/2026/lerobot-pickle-rce/"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/huggingface/lerobot/issues/3047"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/huggingface/lerobot/pull/3048"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/huggingface/lerobot/issues/3134"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/lerobot-unsafe-deserialization-remote-code-execution-via-grpc"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "LeRobot Unsafe Deserialization Remote Code Execution via gRPC",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-25874",
    "datePublished": "2026-04-23T19:45:01.090Z",
    "dateReserved": "2026-02-06T19:12:03.464Z",
    "dateUpdated": "2026-11-09T19:24:39.218Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115533 (GCVE-0-2026-115533)

Vulnerability from cvelistv5 – Published: 2026-10-26 19:38 – Updated: 2026-10-26 19:38

Title

CVE-2026-115533

Summary

The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the from_pretrained() method and related paths. When loading a policy's processor configuration from a repository, the library uses the class field within the JSON configuration to dynamically resolve and instantiate Python classes using importlib.import_module() and getattr().

Severity

No CVSS data available.

CWE

Assigner

certcc CNA under the mitre root

CNA scorecard E 42/100 over 180 records in the last 180 days details

References

1 reference

URL	Tags
https://gist.github.com/mtholmquist/eba1cba80ea66…

Impacted products

1 product

Vendor	Product	Version
Hugging Face	LeRobot	Affected: 0.4.0 , ≤ 0.6.1 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "LeRobot",
          "vendor": "Hugging Face",
          "versions": [
            {
              "lessThanOrEqual": "0.6.1",
              "status": "affected",
              "version": "0.4.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the from_pretrained() method and related paths. When loading a policy\u0027s processor configuration from a repository,  the library uses the class field within the JSON configuration to dynamically resolve and instantiate Python classes using importlib.import_module() and getattr()."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T19:38:54.907Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://gist.github.com/mtholmquist/eba1cba80ea66997b8f7e6a839e49120"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2026-115533",
      "x_generator": {
        "engine": "VINCE 3.0.51",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-115533"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-115533",
    "datePublished": "2026-10-26T19:38:54.907Z",
    "dateReserved": "2026-10-22T19:09:47.515Z",
    "dateUpdated": "2026-10-26T19:38:54.907Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-25874 (GCVE-0-2026-25874)

Vulnerability from cvelistv5 – Published: 2026-04-23 19:45 – Updated: 2026-11-09 19:24 X_Open Source

Title

LeRobot Unsafe Deserialization Remote Code Execution via gRPC

Summary

LeRobot through 0.6.1 contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads() is used to deserialize data received over unauthenticated gRPC channels without TLS in the policy server and robot client components. An unauthenticated network-reachable attacker can achieve arbitrary code execution on the server or client by sending a crafted pickle payload through the SendPolicyInstructions, SendObservations, or GetActions gRPC calls.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-24 14:34 UTC

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8197 records in the last 180 days details

References

5 references

URL	Tags
https://chocapikk.com/posts/2026/lerobot-pickle-rce/	exploit
https://github.com/huggingface/lerobot/issues/3047	issue-tracking
https://github.com/huggingface/lerobot/pull/3048	issue-trackingpatch
https://github.com/huggingface/lerobot/issues/3134	issue-tracking
https://www.vulncheck.com/advisories/lerobot-unsa…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
Hugging Face	LeRobot	Affected: 0 , ≤ 0.6.1 (semver) cpe:2.3:a:huggingface:lerobot::::::python::*

Date Public

2026-02-27 00:00

Credits

Valentin Lobstein (Chocapikk)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25874",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-24T14:34:03.307494Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-24T18:20:13.815Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "packageURL": "pkg:pypi/lerobot",
          "product": "LeRobot",
          "repo": "https://github.com/huggingface/lerobot",
          "vendor": "Hugging Face",
          "versions": [
            {
              "lessThanOrEqual": "0.6.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:huggingface:lerobot:*:*:*:*:*:python:*:*",
                  "versionEndIncluding": "0.6.1",
                  "vulnerable": true
                }
              ],
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Valentin Lobstein (Chocapikk)"
        }
      ],
      "datePublic": "2026-02-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "LeRobot through 0.6.1 contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads() is used to deserialize data received over unauthenticated gRPC channels without TLS in the policy server and robot client components. An unauthenticated network-reachable attacker can achieve arbitrary code execution on the server or client by sending a crafted pickle payload through the SendPolicyInstructions, SendObservations, or GetActions gRPC calls."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T19:24:39.218Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://chocapikk.com/posts/2026/lerobot-pickle-rce/"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/huggingface/lerobot/issues/3047"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/huggingface/lerobot/pull/3048"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/huggingface/lerobot/issues/3134"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/lerobot-unsafe-deserialization-remote-code-execution-via-grpc"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "LeRobot Unsafe Deserialization Remote Code Execution via gRPC",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-25874",
    "datePublished": "2026-04-23T19:45:01.090Z",
    "dateReserved": "2026-02-06T19:12:03.464Z",
    "dateUpdated": "2026-11-09T19:24:39.218Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

4 vulnerabilities found for LeRobot by Hugging Face

CVE-2026-115533 (GCVE-0-2026-115533)

CVE-2026-25874 (GCVE-0-2026-25874)

CVE-2026-115533 (GCVE-0-2026-115533)

CVE-2026-25874 (GCVE-0-2026-25874)