CVE-2026-115533: LeRobot unsafe dynamic class instantiation in from_pretrained()

CVE-2026-115533 · Severity: info · Published 2026-10-26

LeRobot is a robotics library that loads policy configurations from repositories to control robot behavior. An attacker can craft a malicious configuration file that executes arbitrary code when the policy is loaded, allowing them to run commands on any system using LeRobot. No authentication or special configuration is required to trigger this attack.

Vendors: Hugging Face.

Quick answers

Is CVE-2026-115533 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-115533 being exploited in the wild.
How severe is CVE-2026-115533?
Informational severity, published 26 October 2026.
Which products and versions are affected?
Hugging Face LeRobot 0.4.0 through 0.6.1.
Is there a fix for CVE-2026-115533?
Yes: fixed in None as of 2026-10-22. Until then: An unmerged community pull request (#4285) proposes adding a namespace allowlist and trust_remote_code gate; until a fix is released, avoid loading policy configurations from untrusted Hugging Face Hub repositories or restrict network access to hub communication. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115533 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-115533?
Check whether you run Hugging Face LeRobot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: None as of 2026-10-22

An unmerged community pull request (#4285) proposes adding a namespace allowlist and trust_remote_code gate; until a fix is released, avoid loading policy configurations from untrusted Hugging Face Hub repositories or restrict network access to hub communication.

Technical details

The library's DataProcessorPipeline.from_pretrained() method dynamically resolves and instantiates Python classes specified in JSON configuration files via importlib.import_module() and getattr() without validation or allowlisting. An attacker can set the "class" field to any importable callable (e.g., subprocess.Popen) with attacker-controlled constructor arguments; code execution occurs during class instantiation before downstream isinstance() checks that should guard against invalid processor types. The vulnerability requires network access to serve a malicious configuration but no prior authentication or user interaction beyond loading the policy.

Affected products

  • Hugging Face LeRobot 0.4.0 through 0.6.1

Timeline

  • 2026-10-22: disclosed
  • 2026-10-26: advisory: Published as CVE-2026-115533

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.