CVE-2026-25874
Published: 23 April 2026
Description
LeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads() is used to deserialize data received over unauthenticated gRPC channels without TLS in the policy server and robot client components. An unauthenticated network-reachable attacker can…
more
achieve arbitrary code execution on the server or client by sending a crafted pickle payload through the SendPolicyInstructions, SendObservations, or GetActions gRPC calls.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the CVE by requiring timely patching of the unsafe deserialization flaw in LeRobot's async inference pipeline.
Requires validation of gRPC payloads from SendPolicyInstructions, SendObservations, and GetActions calls to block crafted pickle payloads before deserialization.
Monitors and controls network communications at system boundaries to prevent unauthenticated network-reachable attackers from accessing vulnerable gRPC endpoints.
Security SummaryAI
CVE-2026-25874 is an unsafe deserialization vulnerability (CWE-502) affecting LeRobot through version 0.5.1. The issue resides in the async inference pipeline of the policy server and robot client components, where the pickle.loads() function deserializes data received over unauthenticated gRPC channels lacking TLS protection. Published on 2026-04-23, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact exploitation.
An unauthenticated attacker with network reach to the affected server or client can exploit the vulnerability by transmitting a crafted pickle payload via the SendPolicyInstructions, SendObservations, or GetActions gRPC calls. Successful exploitation leads to arbitrary code execution on the target system, allowing full compromise including data theft, persistence, or further lateral movement.
Mitigation details are outlined in vendor advisories and GitHub references, including issues #3047 and #3134 on the Hugging Face LeRobot repository, a patch via pull request #3048, a technical post at chocapikk.com/posts/2026/lerobot-pickle-rce/, and a VulnCheck advisory at vulncheck.com/advisories/lerobot-unsafe-deserialization-remote-code-execution-via-grpc. Security practitioners should upgrade to a patched version beyond 0.5.1 and ensure gRPC endpoints are not exposed to untrusted networks.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables unauthenticated remote code execution via crafted payloads over exposed gRPC endpoints in a public-facing policy server and client, directly mapping to exploitation of public-facing applications.