Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-115533 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the from_pretrained() method and related paths. When loading a policy's processor configuration from a repository, the library uses the class field within the JSON configuration to dynamically resolve and instantiate Python classes using importlib.import_module() and getattr().

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:7.8 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://gist.github.com/mtholmquist/eba1cba80ea66997b8f7e6a839e49120	[email protected]	ExploitRemedyTechnical Analysis

Weakness Enumeration

No weakness enumeration is available for this CVE.

Affected Products

Product	Versions
Hugging Face LeRobot	>= 0.4.0, <= 0.6.1 (semver) main
CPE No CPEs found in CPE dictionary for this product. Remediation Workaround:low effort Only load LeRobot policies from repositories you control or trust. Do not call `from_pretrained()` or `make_pre_post_processors()` against untrusted Hub repositories. Workaround:low effort When loading from the Hugging Face Hub, pin an exact reviewed revision rather than a floating reference. Workaround:low effort Run policy loading in a sandboxed environment with no outbound network and least privilege, since loading can execute arbitrary code.

Product

Versions

Hugging Face LeRobot

>= 0.4.0, <= 0.6.1 (semver)

main

CPE

No CPEs found in CPE dictionary for this product.

Remediation

Workaround:low effort
Only load LeRobot policies from repositories you control or trust. Do not call `from_pretrained()` or `make_pre_post_processors()` against untrusted Hub repositories.
Workaround:low effort
When loading from the Hugging Face Hub, pin an exact reviewed revision rather than a floating reference.
Workaround:low effort
Run policy loading in a sandboxed environment with no outbound network and least privilege, since loading can execute arbitrary code.

Change History

1 change record found show changes