Hugging Face LeRobot platform vulnerable to unauthenticated remote code execution
Hugging Face's LeRobot robotics platform contains a critical remote code execution vulnerability (CVE-2026-25874) in its PolicyServer component that allows unauthenticated attackers to execute arbitrary code via malicious Pickle payloads. The vulnerability, disclosed in early 2026 after being reported in December 2025, requires substantial code reconstruction to fix.
What happened
Hugging Face's open source robotics platform LeRobot contains a critical unsafe deserialization vulnerability (CVE-2026-25874).
Unauthenticated attackers can send specially crafted serialized Pickle payloads via SendPolicyInstructions, SendObservations or GetActions gRPC calls to execute arbitrary code on servers or clients.
The vulnerability stems from the PolicyServer asynchronous inference component, which allows attackers to access relevant ports without authentication and send serialized malicious payloads to execute arbitrary operating system-level commands.
The vulnerability was first reported in December 2025, and the LeRobot development team acknowledged it in January 2026, stating that nearly all related code requires rebuilding to fix it.
Reported impact
Because the platform is designed for AI inference systems with high privileges requiring access to internal networks, datasets and computing resources, exploitation could allow attackers to completely penetrate PolicyServer, steal sensitive data, perform lateral movement across networks, affect connected robots, corrupt models, cause system crashes, and potentially create physical safety risks.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.