CVE-2026-25874 describes a critical unsafe deserialization vulnerability in Hugging Face's LeRobot (up to version 0.5.1). The async inference pipeline uses Python's pickle.loads() to deserialize data received over unauthenticated and unencrypted gRPC channels in the policy server and robot client components. This allows an unauthenticated network attacker to execute arbitrary code remotely by sending malicious pickle payloads through the SendPolicyInstructions, SendObservations, or GetActions gRPC calls. The vulnerability is categorized under CWE-502 and has a CVSS 4.0 score of 9.3, indicating high impact and exploitability. No patch or official fix has been published yet, and the product is not a cloud service, so remediation depends on vendor updates or user mitigations.

An unauthenticated attacker with network access to the affected LeRobot components can achieve arbitrary code execution on both the server and client by exploiting unsafe deserialization of untrusted data. This can lead to full compromise of the affected systems running LeRobot versions through 0.5.1. The vulnerability affects the policy server and robot client components communicating over unauthenticated gRPC channels without TLS, increasing exposure to remote exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting network access to the affected gRPC endpoints, implementing network-level authentication or encryption (e.g., TLS), or disabling vulnerable functionality if possible. Avoid exposing the policy server and robot client components to untrusted networks. Monitor vendor channels for updates and patches.