Read the docs
TI-2026-80565 Aliases CVE-2026-115533GHSA-25pw-xj75-472h

Code execution in Hugging Face LeRobot via unsafe class instantiation

Priority LOW 23Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
No fix listed

No CVSS vector from any source. Fix status from CNA.

Summary

Hugging Face LeRobot versions from 0.4.0 through 0.6.1 are affected. Loading a policy's processor configuration from a repository resolves and instantiates Python classes named in the JSON class field. A user who loads a policy from a malicious repository can run arbitrary code chosen by the attacker through from_pretrained().

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the from_pretrained() method and related paths. When loading a policy's processor configuration from a repository, the library uses the class field within the JSON configuration to dynamically resolve and instantiate Python classes using importlib.import_module() and getattr().

Why it matters now

EPSS 0.00342 27th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
huggingfaceLeRobot0.4.0 – 0.6.1—No fix listedCNA
  • LeRobot Vendorhuggingface Affected 0.4.0 – 0.6.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for LeRobot.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-115533
  2. 2026-10-27 Alias added: GHSA-25pw-xj75-472h
  3. 2026-11-06 Affected versions changed · Red Hat
  4. 2026-11-06 CVSS score added · Red Hat

References

Other 1

  • TI-2026-48351 sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False CVSS 4.0CRITICAL 9.3
  • TI-2026-20914 LeRobot Unsafe Deserialization Remote Code Execution via gRPC CVSS 4.0CRITICAL 9.3
  • TI-2026-04577 Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers CVSS 3.1CRITICAL 9.6
  • TI-2025-04589 Sandbox Escape Vulnerability in huggingface/smolagents CVSS 3.1CRITICAL 10.0
  • TI-2026-79938 Pickle deserialization in Hugging Face Datasets allows code execution CVSS 4.0HIGH 8.7
  • TI-2026-32710 Diffusers: None.py Trust Remote Code Bypass CVSS 3.1HIGH 8.8
See all 58 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences