Skip to content
OpenAdvisories

Product · Hugging Face

LeRobot

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.3
    CVE-2026-25874 EPSS 16%

    LeRobot Unsafe Deserialization Remote Code Execution via gRPC

    LeRobot through 0.6.1 contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads() is used to deserialize data received over unauthenticated gRPC channels without TLS in the policy server and robot client components. A…

    Hugging Face LeRobot