Huggingface Lerobot vulnerabilities
2 vulnerabilities
Known vulnerabilities in Huggingface Lerobot, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
PrioritiseCVE-2026-25874hugging face · lerobot +1 moreLeRobot Unsafe Deserialization Remote Code Execution via gRPCLeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads() is used to deserialize data received over unauthenticated gRPC channels without TLS in the policy server and robot client components. An unauthenticated network-reachable attacker can achieve arbitrary code execution on the server or client by sending a crafted pickle payload through the SendPolicyInstructions, SendObservations, or GetActions gRPC calls.CVSS9.8CriticalEPSS15.55%RoutineCVE-2025-10772huggingface · lerobothuggingface LeRobot ZeroMQ Socket lekiwi_remote.py missing authenticationA vulnerability was identified in huggingface LeRobot up to 0.3.3. Affected by this vulnerability is an unknown functionality of the file lerobot/common/robot_devices/robots/lekiwi_remote.py of the component ZeroMQ Socket Handler. The manipulation leads to missing authentication. The attack can only be initiated within the local network. The vendor was contacted early about this disclosure but did not respond in any way.CVSS6.3MediumEPSS0.29%