CVE-2026-25874: Huggingface Lerobot insecure deserialization (CVSS 9.8)

Description

LeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads() is used to deserialize data received over unauthenticated gRPC channels without TLS in the policy server and robot client components. An unauthenticated network-reachable attacker can achieve arbitrary code execution on the server or client by sending a crafted pickle payload through the SendPolicyInstructions, SendObservations, or GetActions gRPC calls.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Huggingface Lerobot≤ 0.5.1

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

https://github.com/huggingface/lerobot/pull/3048

References

https://chocapikk.com/posts/2026/lerobot-pickle-rce/ExploitMitigationThird Party Advisory
https://github.com/huggingface/lerobot/issues/3047ExploitIssue TrackingThird Party Advisory
https://github.com/huggingface/lerobot/issues/3134Issue Tracking
https://github.com/huggingface/lerobot/pull/3048Issue TrackingPatch
https://www.vulncheck.com/advisories/lerobot-unsafe-deserialization-remote-code-execution-via-grpcExploitThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-25874 being actively exploited?

CVE-2026-25874 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.95%.

How severe is CVE-2026-25874?

CVE-2026-25874 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 0.95% probability of exploitation.

Which products are affected by CVE-2026-25874?

Affected products include Huggingface Lerobot.

How do I fix CVE-2026-25874?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-25874 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo