---
id: CVE-2026-115533
title: CVE-2026-115533
summary: >-
  The LeRobot library is vulnerable to arbitrary code execution via unsafe
  dynamic class instantiation in the from_pretrained() method and related paths.
  When loading a policy's processor configuration from a repository,  the
  library uses …
severity: none
cwe:
  - CWE-502
  - CWE-94
vendor: Hugging Face
product: LeRobot
affected:
  - LeRobot >= 0.4.0 <= 0.6.1
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T19:38:54.907Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115533'
references:
  - url: 'https://gist.github.com/mtholmquist/eba1cba80ea66997b8f7e6a839e49120'
tags:
  - cve.org
ingestedAt: '2026-10-26T20:39:42.645Z'
epss: 0.00342
epssPercentile: 0.27604
---

## Overview

The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the from_pretrained() method and related paths. When loading a policy's processor configuration from a repository,  the library uses the class field within the JSON configuration to dynamically resolve and instantiate Python classes using importlib.import_module() and getattr().

## Affected

- `LeRobot >= 0.4.0 <= 0.6.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.