{"id":"CVE-2026-115533","title":"CVE-2026-115533","summary":"The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the from_pretrained() method and related paths. When loading a policy's processor configuration from a repository,  the library uses …","severity":"none","cwe":["CWE-502","CWE-94"],"vendor":"Hugging Face","product":"LeRobot","affected":["LeRobot >= 0.4.0 <= 0.6.1"],"published":"2026-10-26","updated":"2026-10-26","sourceUpdated":"2026-10-26T19:38:54.907Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115533","references":[{"url":"https://gist.github.com/mtholmquist/eba1cba80ea66997b8f7e6a839e49120"}],"tags":["cve.org"],"ingestedAt":"2026-10-26T20:39:42.645Z","epss":0.00342,"epssPercentile":0.27604,"slug":"CVE-2026-115533","body":"## Overview\n\nThe LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the from_pretrained() method and related paths. When loading a policy's processor configuration from a repository,  the library uses the class field within the JSON configuration to dynamically resolve and instantiate Python classes using importlib.import_module() and getattr().\n\n## Affected\n\n- `LeRobot >= 0.4.0 <= 0.6.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}