Is CVE-2026-25874 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25874 being exploited in the wild.

How severe is CVE-2026-25874?

Critical severity, with a CVSS score of 9.8, published 23 April 2026.

Is there a fix for CVE-2026-25874?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-25874 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-25874?

Check whether you run Huggingface Lerobot. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25874: Hugging Face LeRobot insecure deserialization in gRPC PolicyServer

CVE-2026-25874 · Severity: critical · CVSS 9.8 · Published 2026-04-23

Hugging Face LeRobot, an open-source robotics framework, contains a critical security flaw in its remote communication system. This system allows robots to offload complex calculations to a more powerful server. Because the software does not properly verify the data it receives over the network, an attacker can send malicious commands that take complete control of either the robot or the server. This could lead to unauthorized access to sensitive camera feeds, theft of proprietary AI models, or the execution of arbitrary code on connected hardware.

Vendors: Huggingface.

Quick answers

Is CVE-2026-25874 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25874 being exploited in the wild.
How severe is CVE-2026-25874?: Critical severity, with a CVSS score of 9.8, published 23 April 2026.
Which products and versions are affected?: Hugging Face LeRobot <= 0.5.1.
Is there a fix for CVE-2026-25874?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-25874 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-25874?: Check whether you run Huggingface Lerobot. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

LeRobot (up to version 0.5.1) contains an unsafe deserialization vulnerability (CWE-502) within its asynchronous inference pipeline. The 'PolicyServer' and 'RobotClient' components utilize Python's 'pickle.loads()' to process data received via gRPC calls, including 'SendPolicyInstructions', 'SendObservations', and 'GetActions'. These gRPC channels are unauthenticated and do not use TLS (configured via 'add_insecure_port'). An attacker can achieve arbitrary code execution by sending a crafted pickle payload; the execution occurs during deserialization, before any type validation (such as 'isinstance' checks) is performed. A patch is available in version 0.6.0 which refactors the communication protocol to avoid unsafe deserialization.

Affected products

Hugging Face LeRobot <= 0.5.1

Timeline

2025-12: disclosed: Initial private report submitted via GitHub Security tab by independent researcher.
2026-01-07: other: Maintainer acknowledged the security risk in public issue tracker.
2026-04-22: other: Detailed technical write-up and PoC published by researcher.
2026-04-23: advisory: CVE-2026-25874 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.