Hugging Face's open source robotics framework LeRobot has been hit by a critical remote-code-execution issue: if an attacker can reach the service port, they can take over the machine without a username, password or certificate. The vulnerability is tracked as CVE-2026-25874.
Where the bug sits
LeRobot commonly runs trained policy models on a GPU server while a front-end robot calls a gRPC PolicyServer for action instructions. That design is not the problem. The dangerous part is the communication layer, where Python pickle.loads() is used on data coming into the service.
Pickle is not a passive interchange format like JSON or protobuf. During deserialization it can rebuild arbitrary Python objects and trigger logic, including calls that end in command execution. In this case, the affected RPC handlers are SendPolicyInstructions() and SendObservations(). Both accept raw bytes and pass them directly into pickle without type validation.
A crafted payload with an os.system() call can therefore run as soon as the server deserializes it. The risk is amplified because the PolicyServer uses add_insecure_port() by default, meaning no TLS and no authentication. Even inside a private network, reachability is enough.
Why robot stacks make this worse
The confirmed affected release is LeRobot v0.4.3 from PyPI, and earlier versions using the same asynchronous inference architecture are likely exposed as well. The project has more than 21,500 GitHub stars and is one of the most visible open source robotics efforts; at publication time, a fixed release had not yet been issued.
A compromised PolicyServer is not just another app server. These systems often run with high privileges on GPU machines, sit next to datasets and model weights, connect to physical robot hardware, and can become a bridge into other internal hosts. In production lines or medical robotics, that turns a software flaw into a physical-safety problem.
What teams should do now
Researchers recommend replacing pickle with JSON, protobuf fields or Hugging Face's safetensors where possible, enabling TLS with secure gRPC ports, binding the service to private interfaces, firewalling the port and disabling policy-server exposure until a real patch is available. Those steps reduce the blast radius, but the durable fix still depends on Hugging Face shipping a corrected version.
The broader lesson is familiar from older PyTorch model-file incidents: machine-learning teams use pickle because it is fast, convenient and deeply embedded in the ecosystem. Once model files, policy instructions or observation channels accept outside input, that convenience becomes a live execution surface.
Sources: CocoLoop, CVE-2026-25874: Hugging Face LeRobot Unauthenticated RCE via Pickle Deserialization (Resecurity); Critical CVE-2026-25874 Leaves Hugging Face LeRobot Open to Unauthenticated RCE (The Hacker News)