CVE-2026-25874: Deserialization of Untrusted Data in Hugging Face LeRobot
LeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads() is used to deserialize data received over unauthenticated gRPC channels without TLS in the policy server and robot client components. An unauthenticated network-reachable attacker can achieve arbitrary code execution on the server or client by sending a crafted pickle payload through the SendPolicyInstructions, SendObservations, or GetActions gRPC calls.
AI Analysis
Technical Summary
CVE-2026-25874 is a critical vulnerability in Hugging Face's LeRobot (<=0.5.1) caused by unsafe deserialization of untrusted data using pickle.loads() in the async inference pipeline. The affected components (policy server and robot client) accept data over unauthenticated gRPC channels without TLS, exposing them to remote unauthenticated attackers. Exploitation is possible through the SendPolicyInstructions, SendObservations, or GetActions gRPC calls by sending maliciously crafted pickle payloads, leading to arbitrary code execution on the server or client.
Potential Impact
Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code on the affected server or client components, potentially leading to full system compromise. The vulnerability has a CVSS 4.0 score of 9.3 (critical), reflecting its high impact and ease of exploitation over the network without authentication.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict network access to the affected gRPC services, implement TLS to secure communication channels, and avoid sending untrusted data to the vulnerable deserialization endpoints. Monitor vendor channels for updates and apply patches promptly once released.
CVE-2026-25874: Deserialization of Untrusted Data in Hugging Face LeRobot
Description
LeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads() is used to deserialize data received over unauthenticated gRPC channels without TLS in the policy server and robot client components. An unauthenticated network-reachable attacker can achieve arbitrary code execution on the server or client by sending a crafted pickle payload through the SendPolicyInstructions, SendObservations, or GetActions gRPC calls.
CVSS v4.0
Score 9.3critical
Affected software
pkg:github/huggingface/lerobotRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-25874 is a critical vulnerability in Hugging Face's LeRobot (<=0.5.1) caused by unsafe deserialization of untrusted data using pickle.loads() in the async inference pipeline. The affected components (policy server and robot client) accept data over unauthenticated gRPC channels without TLS, exposing them to remote unauthenticated attackers. Exploitation is possible through the SendPolicyInstructions, SendObservations, or GetActions gRPC calls by sending maliciously crafted pickle payloads, leading to arbitrary code execution on the server or client.
Potential Impact
Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code on the affected server or client components, potentially leading to full system compromise. The vulnerability has a CVSS 4.0 score of 9.3 (critical), reflecting its high impact and ease of exploitation over the network without authentication.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict network access to the affected gRPC services, implement TLS to secure communication channels, and avoid sending untrusted data to the vulnerable deserialization endpoints. Monitor vendor channels for updates and apply patches promptly once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-02-06T19:12:03.464Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69ea8d5f87115cfb685fc9c2
Added to database: 04/23/2026, 21:21:35 UTC
Last enriched: 07/15/2026, 11:07:41 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 162
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.