{"id":737,"date":"2026-04-28T11:53:01","date_gmt":"2026-04-28T11:53:01","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=737"},"modified":"2026-04-28T11:53:01","modified_gmt":"2026-04-28T11:53:01","slug":"critical-unpatched-flaw-leaves-hugging-face-lerobot-open-to-unauthenticated-rce","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=737","title":{"rendered":"Critical Unpatched Flaw Leaves Hugging Face LeRobot Open to Unauthenticated RCE"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Apr 28, 2026<\/span><\/span>Vulnerability \/ Network Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Cybersecurity researchers have disclosed details of a critical security flaw impacting LeRobot<\/a>, Hugging Face’s open-source robotics platform with nearly 24,000 GitHub stars<\/a>, that could be exploited to achieve remote code execution.<\/p>\n

The vulnerability in question is CVE-2026-25874<\/strong> (CVSS score: 9.3), which has been described as a case of untrusted data deserialization stemming from the use of the unsafe pickle format.<\/p>\n

\u00abLeRobot contains an unsafe deserialization vulnerability in the async inference pipeline, where pickle.loads() is used to deserialize data received over unauthenticated gRPC channels without TLS in the policy server and robot client components,\u00bb according to a GitHub advisory<\/a> for the flaw.<\/p>\n

\u00abAn unauthenticated network-reachable attacker can achieve arbitrary code execution on the server or client by sending a crafted pickle payload through the SendPolicyInstructions, SendObservations, or GetActions gRPC calls.\u00bb<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

According to Resecurity, the problem is rooted<\/a> in the async inference PolicyServer component, allowing an unauthenticated attacker who can reach the PolicyServer network port to send a malicious serialized payload and run arbitrary operating system commands on the host machine running the service.<\/p>\n

<\/p>\n

\"\"<\/a><\/div>\n

The cybersecurity company said the vulnerability is \u00abdangerous\u00bb as the service is designed for artificial intelligence inference systems, which tend to run with elevated privileges to access internal networks, datasets, and expensive compute resources. Should the flaw be exploited by an attacker, it could enable a wide range of actions, including –<\/p>\n