Read the docs

huggingface

Records59All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical6CVSS 9.0–10.0
CVSS high32CVSS 7.0–8.9

Exploited now

huggingface records in CISA KEV

No huggingface vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Transformers 30 records HIGH Smolagents 4 records HIGH Diffusers 3 records HIGH Datasets 1 record MEDIUM Lerobot 1 record HIGH

Records

1 record in Lerobot · all components

TI-2026-20914 CVE-2026-25874 · GHSA-f7vj-73pm-m822

LeRobot Unsafe Deserialization Remote Code Execution via gRPC

Priority HIGH 81

LeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads() is used to deserialize data received over unauthenticated gRPC channels without TLS in the polic…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.15547 Published 2026-04-23 No fix listed CWE-502
Open these records in search →