Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Browse News Feed Stats Watchlists Beta About Contact

LeRobot unsafe deserialization RCE (CVE-2026-25874)

Vulnerability
First reported
Last updated
Happening score
H score 21
1 unique sources, 1 articles

Summary

Hide ▲

The CVE-2026-25874 unsafe deserialization flaw in Hugging Face LeRobot enables unauthenticated remote code execution against network-reachable deployments. The bug sits in the async inference path, where attacker-controlled pickle data is accepted over unauthenticated gRPC channels and can reach the server or client. The issue was validated against version 0.4.3, remains unpatched, and a fix is planned for 0.6.0. Successful exploitation could lead to host compromise, connected robot impact, and theft of sensitive data.

Related Happenings

BeyondTrust Remote Support and Privileged Remote Access CVE-2026-1731 active exploitation wave

Exploitation Wave
First: 12.02.2026 23:34 Last: 12.02.2026 23:34 Sources 1

About this happening: **CVE-2026-1731** in **BeyondTrust Remote Support** and **Privileged Remote Access** is now seeing **first in-the-wild exploitation**, putting exposed appliances at risk of remote...

Open Happening

CISA KEV remediation deadline for SolarWinds WHD CVE-2025-40551

Public Sector Action
First: 04.02.2026 07:50 Last: 04.02.2026 07:50 Sources 1

About this happening: **CISA** added **CVE-2025-40551** in **SolarWinds Web Help Desk** to the **KEV catalog** and imposed **federal remediation deadlines**, turning a newly exploited flaw into a compl...

Open Happening

OpenAI ShadowLeak mitigation for ChatGPT

Advisory/Mitigation
First: 19.09.2025 22:07 Last: 19.09.2025 22:07 Sources 1

About this happening: **OpenAI** acknowledged and fixed **ShadowLeak**, ending a stealthy **ChatGPT** email-exfiltration path in the studied **Gmail** integration. The mitigation mattered because the f...

Open Happening

Timeline

  1. 28.04.2026 14:18 2 articles · 29d ago

    Public disclosure of CVE-2026-25874 in Hugging Face LeRobot

    Initial Disclosure

    Researchers disclose CVE-2026-25874 in Hugging Face LeRobot, an open-source robotics platform, describing an unsafe deserialization flaw in the async inference pipeline where pickle.loads() processes unauthenticated gRPC data without TLS in the PolicyServer and robot client components, enabling unauthenticated remote code execution on network-reachable deployments. The issue is validated against LeRobot version 0.4.3, remains unpatched, and a fix is planned for version 0.6.0.

    Show sources
    Open in new tab