Hugging Face LeRobot Vulnerability Enables Unauthenticated Remote Code Execution Attacks

A critical remote code execution (RCE) vulnerability has been identified in Hugging Face’s LeRobot, an open-source robotics machine learning framework widely adopted across the AI and research community.

Tracked as CVE-2026-25874, the flaw carries a CVSS score of 9.8, enabling unauthenticated attackers to execute arbitrary system commands on vulnerable deployments.

With more than 21,500 GitHub stars, LeRobot’s popularity significantly amplifies the potential impact, particularly in production environments leveraging distributed GPU-based inference.

The vulnerability originates in LeRobot’s asynchronous inference architecture, where policy computation is offloaded to a GPU-backed server via a gRPC-based PolicyServer.

The issue stems from the server’s reliance on Python’s unsafe pickle.loads() function to deserialize incoming data across multiple RPC endpoints.

Compounding the risk, the gRPC service is configured using add_insecure_port(), meaning communications lack Transport Layer Security (TLS) and authentication controls.

This combination allows any attacker with network access to send crafted payloads directly to the service.

Because pickle Inherently allows execution of arbitrary code during deserialization, this design flaw creates a direct path to full system compromise.

Technical Breakdown and Exploitation Path

Security researcher chocapikk identified that vulnerable RPC handlers, including SendPolicyInstructions and SendObservations, process raw byte streams from protobuf messages and deserialize them using pickle before enforcing type validation.

This sequence is critical: malicious payloads execute during deserialization, before validation checks like isinstance() are applied. As a result, even malformed or unexpected objects can trigger code execution.

For example, an attacker can craft a malicious Python object embedded in a serialized payload that executes system-level commands upon deserialization.

Since validation occurs too late, the payload runs regardless of whether the object is ultimately rejected.

Notably, the affected code sections contained #nosec comments suppressing security linter warnings, suggesting developers were aware of the risks associated with unsafe deserialization but bypassed safeguards.

By default, LeRobot binds its gRPC server to localhost, limiting exposure in isolated environments. However, real-world deployments commonly bind services to 0.0.0.0 enable communication with external GPU servers.

In such configurations, the attack surface expands significantly. Threat actors can scan networks for exposed instances and deliver malicious payloads without authentication or advanced targeting, making the vulnerability highly exploitable at scale.

Mitigation and Remediation Measures

Organizations using LeRobot should take immediate steps to mitigate CVE-2026-25874:

• Remove unsafe serialization by replacing pickle with secure alternatives such as JSON, native protobuf fields, or Hugging Face’s safetensors.
• Enable encrypted communication by switching from add_insecure_port() to add_secure_port() with TLS.
• Enforce authentication using gRPC interceptors and token-based access controls for all incoming requests.

This vulnerability highlights a recurring issue in the machine learning ecosystem: prioritizing rapid prototyping over secure coding practices.

Despite Hugging Face’s development of safetensors to address serialization risks, the presence of a pickle-Based RCE flaw in LeRobot underscores inconsistent security implementation.

As ML frameworks continue to integrate into production and robotics systems, secure design principles must become foundational rather than optional, particularly in distributed architectures handling untrusted network input.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google

The post Hugging Face LeRobot Vulnerability Enables Unauthenticated Remote Code Execution Attacks appeared first on Cyber Security News.