A critical vulnerability in Hugging Face’s LeRobot open-source robotics platform could let an unauthenticated attacker run arbitrary code on affected systems, according to a GitHub advisory. The flaw, tracked as CVE-2026-25874 and rated 9.3 out of 10, affects the async inference pipeline and was validated against version 0.4.3.
KEY FACTS
- Issue Unsafe deserialization through
pickle.loads()in the async inference pipeline. - Exposure The vulnerable gRPC calls are reachable without authentication and without TLS.
- Impact An attacker could run code on the server or client, steal data or disrupt connected robots.
- Status A fix is planned for version 0.6.0 and the issue remains unpatched.
The report says the flaw affects the PolicyServer and robot client components, where network input is deserialized from crafted pickle payloads. That behavior can allow command execution on the host machine running the service.
Resecurity said the issue is especially concerning because the service is designed for AI inference systems, which may run with elevated privileges and access internal networks, datasets and compute resources. The disclosure said possible outcomes include theft of API keys, SSH credentials and model files, along with lateral movement across a network.
The same weakness was also reported earlier by another researcher, and the LeRobot team said in January that the code section would need a broad refactor because it was originally more experimental. The project lead said LeRobot had been focused mainly on research and prototyping, but that security will matter more as production use grows.
WHY IT MATTERS
The case highlights the risk of using pickle to process untrusted data, especially in systems tied to robotics and AI infrastructure. If exploited, the flaw could affect both digital assets and physical operations.