CVE-2026-25874: LeRobot Unsafe Deserialization Leading to Remote Code Execution via gRPC
CVE-2026-25874 affects LeRobot through 0.5.1 and involves unsafe deserialization (CWE-502) in the async inference pipeline, where data from unauthenticated, non-TLS gRPC channels is processed with pickle. The NVD base score is 9.8 (critical), and the record describes network-reachable code execution without authentication. No confirmed exploitation appears in the sources consulted, and no fixed version is stated in the record.
Overview
LeRobot (listed in the record as Huggingface Lerobot) is affected by CWE-502, deserialization of untrusted data, in its async inference pipeline. According to the record, data received over unauthenticated gRPC channels without TLS is deserialized with pickle in both the policy server and the robot client components.
Impact
- The record states that an unauthenticated, network-reachable attacker can achieve arbitrary code execution on the affected server or client.
- NVD assigns a base score of 9.8 (critical). VulnCheck assigns 9.3 under its newer CVSS framework.
- The record describes a total technical impact in the SSVC assessment.
Affected products and versions
- Product: Huggingface Lerobot.
- Affected range as recorded: through 0.5.1 (listed as up to and including 0.5.1).
- The record gives no fixed version. A patch reference exists (pull request 3048 in the LeRobot repository), but the record does not state which release contains it.
Exploitation status
The CISA KEV catalog does not list this CVE in the record, so no confirmed active exploitation is stated. The SSVC exploitation field is recorded as proof of concept, and one third-party write-up and the VulnCheck advisory are tagged as exploit-related in the references. The EPSS probability is recorded as 0.00951. These data points do not confirm exploitation in the wild.
Remediation and mitigation
- Identify all LeRobot deployments at or below 0.5.1, including policy servers and robot clients.
- Review the patch reference in the LeRobot repository and the mitigation guidance in the third-party advisory, then confirm with the maintainer which release contains the fix before upgrading.
- Until a fix is verified, restrict network access to the gRPC endpoints to trusted hosts, and do not expose them to untrusted networks.
- Prefer authenticated and encrypted transport for these channels, as the record indicates that the current setup lacks TLS and authentication.
Detection guidance
- Inventory LeRobot versions and gRPC listeners across the environment.
- Monitor for unexpected connections to policy server and robot client gRPC ports from unknown sources.
- Review process and service logs for unexpected child processes or code execution on hosts running these components.
Limitations of the available information
- The record does not state a fixed version.
- The EPSS date in the record (2026-10-23) is later than the publication date, so its currency should be verified.
- The record does not include details of the affected code paths beyond the function names and gRPC methods listed.
- No vendor advisory from the maintainer is among the cited sources other than the pull request and issue tracker entries.
Frequently asked questions
Is CVE-2026-25874 being actively exploited?
The CISA KEV catalog does not list this CVE in the record, so no confirmed active exploitation is stated. The sources consulted do not confirm exploitation in the wild, although the SSVC field records a proof-of-concept status.
Which LeRobot versions are affected?
The record lists LeRobot through 0.5.1, meaning up to and including 0.5.1. No fixed version is stated in the record.
What should administrators do now?
Identify deployments at or below 0.5.1, restrict gRPC access to trusted hosts, and confirm with the maintainer which release contains the fix before upgrading.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.