Hugging Face LeRobot Critical RCE Vulnerability Patched

Key Takeaways

• A critical remote code execution (RCE) vulnerability, CVE-2026-25874, has been identified in Hugging Face’s LeRobot framework.
• The flaw, rated 9.3 CVSS, allows unauthenticated attackers to execute arbitrary commands on systems running LeRobot versions up to 0.5.1.
• The vulnerability stems from insecure deserialization using Python’s pickle module over unauthenticated gRPC channels.
• A patch is anticipated in LeRobot version 0.6.0, but immediate network restrictions are advised.

Hugging Face’s LeRobot, an open-source machine learning framework widely adopted for real-world robotics applications, is currently grappling with a severe, unpatched remote code execution (RCE) vulnerability. This critical flaw, identified as CVE-2026-25874 and boasting a CVSS score of 9.3, enables attackers to execute arbitrary system commands on affected host machines without requiring authentication.

Given LeRobot’s extensive use, evidenced by nearly 24,000 stars on GitHub, this vulnerability poses a significant threat to AI infrastructure, networked robotic systems, and sensitive proprietary data. A successful exploit could lead to complete system compromise, data exfiltration, and even the physical sabotage of connected robots.

Insecure Pickle Deserialization at Core of Flaw

Security researcher Chocapikk published a detailed proof-of-concept, highlighting the vulnerability within LeRobot’s async inference module. This module is designed to offload intensive computations to GPU servers, a common practice in modern AI systems.

The issue arises from the interaction between the PolicyServer and RobotClient components, which rely on Python’s native pickle module for deserializing data transmitted across unauthenticated gRPC channels. Critically, the gRPC server utilizes add_insecure_port(), negating the use of Transport Layer Security (TLS) or any form of authentication. This configuration means that any party with network access can directly connect to the service.

Attackers can exploit this by sending a specially crafted serialized payload via RPC handlers, such as SendPolicyInstructions or SendObservations. This malicious payload executes immediately during the pickle.loads() process, bypassing any subsequent data type validation. The lack of credential requirements and complex attack chains makes this vulnerability particularly potent.

The implications of such an exploit are severe. AI inference servers typically operate with elevated system privileges to manage high-cost GPU resources and vast datasets. A breach could grant attackers full administrative control over the host machine, enabling lateral movement within internal networks, corruption of machine learning models, exfiltration of Hugging Face API keys, and potential disruption of physical robot operations.

This vulnerability actively affects all LeRobot versions up to 0.5.1.

Chocapikk’s researchers also pointed out a significant irony: Hugging Face itself developed the safetensors format specifically to mitigate the inherent security risks associated with pickle serialization. Despite this, LeRobot developers opted for the less secure pickle format, presumably for convenience. Furthermore, as Chocapikk discovered, the source code contained # nosec tags directly adjacent to the pickle.loads() calls. These comments were intentionally placed to suppress warnings from automated security linters that accurately flagged the vulnerability during development.

What You Should Do

A permanent resolution, involving the replacement of pickle with safetensors and JSON, is slated for LeRobot version 0.6.0. Until this official patch becomes available, organizations must implement immediate defensive measures to protect their systems:

• Strictly limit network access, ensuring that the LeRobot async inference server is never exposed to untrusted networks or the public internet.
• Configure the server to bind exclusively to localhost (127.0.0.1) instead of 0.0.0.0 to prevent all external connection attempts.
• Deploy robust API gateways, VPNs, and network-level firewalls to enforce stringent authentication protocols before any traffic can reach the gRPC port.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.