CVE-2026-25874

Untrusted inference messages could execute code on LeRobot workers

Hugging Face LeRobot project / VulnCheck · LeRobot asynchronous policy inference

First documented disclosure · Review checkpoint

Summary

The old asynchronous inference components accepted network data in a Python serialization format capable of executing code.

Severity and exploitation evidence

Critical · 9.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed sources describe the vulnerability and its conditions. They do not identify malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The policy server and robot client decoded messages before authenticating their sender. Their transport did not protect the data in transit.

Conditions required

An attacker can communicate with an exposed component using the affected asynchronous inference stack.

Potential impact

Code could run with the privileges of the policy server or robot client. The sources do not establish a physical outcome.

Affected versions and configurations

VulnCheck lists releases through 0.6.1.

Fix and mitigation status

LeRobot 0.7.0 removes the affected module.

Practical next steps

Migrate to the remote inference stack introduced in 0.7.0. Restrict access to legacy inference services until migration is complete.

Operating lesson

Authenticate inference peers and use a data format that cannot run code during decoding.

Evidence and limits

An early proposed patch was closed without merging. The maintainers merged a replacement inference engine in October, and the November 5 release notes explicitly document removal of the affected module.

Sources