What Happened

On April 28, 2026, security researchers disclosed a critical remote code execution (RCE) flaw in Hugging Face’s open‑source robotics framework LeRobot. The vulnerability, tracked as CVE‑2026‑25874, carries a CVSS score of 9.3 (per The Hacker News) and effectively grants unauthenticated attackers the ability to run arbitrary system commands on any machine running a vulnerable LeRobot service.

Technical Analysis

The root cause lies in LeRobot’s async inference pipeline, where the pickle.loads() function is used to deserialize data received over unauthenticated gRPC channels. Because the server is started with add_insecure_port(), there is no TLS or authentication, allowing any network‑reachable actor to send a crafted payload to RPC handlers such as SendPolicyInstructions or SendObservations. When the malicious payload is processed, pickle.loads() executes the embedded code immediately, giving the attacker full system control (see the detailed proof‑of‑concept published by Chocapikk).

The flaw affects all LeRobot versions up to 0.5.1 – the latest stable release at the time of disclosure. A fix is slated for version 0.6.0, but it has not yet been released. The CVSS score of 9.8 is reported by Cyber Press, reflecting the severe impact on confidentiality, integrity, and availability.

Who’s Affected

LeRobot is widely adopted in AI‑powered robotics research and production. With over 24,000 stars on GitHub (as noted by CyberSecurityNews) and more than 58,000 community‑contributed datasets hosted on the Hugging Face Hub, the framework powers a range of deployments—from research prototypes to industrial robot controllers. Any organization that runs LeRobot’s async inference server on a publicly reachable network is at risk. The vulnerability also threatens downstream services that rely on LeRobot for policy computation, model serving, or robot control, potentially leading to data exfiltration, credential theft, and even physical safety hazards when compromised robots act on malicious commands.

How to Protect Yourself

Restrict Network Access: Bind the inference server to localhost or use a firewall to allow connections only from trusted internal hosts.
Enable TLS and Authentication: Switch from add_insecure_port() to add_secure_port() with proper TLS certificates, and enforce token‑based authentication on all gRPC endpoints.
Replace Pickle Deserialization: Migrate to safe serialization formats such as safetensors, JSON, or protobuf‑native fields. If pickle must be used, wrap calls with strict validation and remove any #nosec comments that silence linters.
Update Immediately: Apply the forthcoming patch in LeRobot 0.6.0 as soon as it is released. Until then, consider forking the repository and back‑porting the serialization fix.
Monitor for Exploitation: Watch for indicators of compromise such as unexpected grpc traffic, new processes executing under the inference service user, or abnormal filesystem changes in the LeRobot working directory.

The Sable Angle

At Sable we specialize in hardening AI‑driven infrastructure. Our team can help you audit your LeRobot deployment, replace unsafe deserialization with Sable‑Safetensors™, and implement zero‑trust network segmentation to keep your robotic fleets safe. Get in touch to run a free security assessment and ensure your AI pipelines are production‑ready.