---
id: CVE-2026-25874
title: LeRobot Unsafe Deserialization Remote Code Execution via gRPC
summary: >-
  LeRobot through 0.6.1 contains an unsafe deserialization vulnerability in the
  async inference pipeline where pickle.loads() is used to deserialize data
  received over unauthenticated gRPC channels without TLS in the policy server
  and robo…
severity: critical
cvss: 9.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-502
vendor: Hugging Face
product: LeRobot
affected:
  - LeRobot <= 0.6.1
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-04-24T14:34:03.307494Z'
exploitAvailable: true
published: '2026-04-23'
updated: '2026-11-09'
sourceUpdated: '2026-11-09T19:24:39.218Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-25874'
references:
  - url: 'https://chocapikk.com/posts/2026/lerobot-pickle-rce/'
  - url: 'https://github.com/huggingface/lerobot/issues/3047'
  - url: 'https://github.com/huggingface/lerobot/pull/3048'
  - url: 'https://github.com/huggingface/lerobot/issues/3134'
  - url: >-
      https://www.vulncheck.com/advisories/lerobot-unsafe-deserialization-remote-code-execution-via-grpc
tags:
  - cve.org
  - exploit-available
epss: 0.15547
epssPercentile: 0.96853
ingestedAt: '2026-11-08T14:51:22.470Z'
---

## Overview

LeRobot through 0.6.1 contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads() is used to deserialize data received over unauthenticated gRPC channels without TLS in the policy server and robot client components. An unauthenticated network-reachable attacker can achieve arbitrary code execution on the server or client by sending a crafted pickle payload through the SendPolicyInstructions, SendObservations, or GetActions gRPC calls.

## Affected

- `LeRobot <= 0.6.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.