CVE-2026-25874

The policy server and robot client components use pickle.loads() function to deserialize data received through gRPC channels, which are not protected by authentication or TLS encryption. An attacker can send a crafted pickle payload via gRPC calls: SendPolicyInstructions, SendObservations, or GetActions. Since gRPC channels are accessible without authentication, anyone network-reachable can deliver a malicious object that will be executed by the Python interpreter during deserialization.

An attacker can obtain complete remote code execution (RCE) on the policy server or robot client, which in practice means the ability to take over the system, steal data, install malicious software, or disrupt the operation of physical robotic hardware.

Apply patches available from the manufacturer according to the references (pull request #3048 in the huggingface/lerobot GitHub repository). Until the update is applied, it is recommended to restrict network access to gRPC ports only to trusted hosts using a firewall and avoid exposing the service to the public network.

Huggingface LeRobot in versions up to and including 0.5.1, in configurations using the asynchronous inference pipeline (policy server and robot client components with gRPC channels).