CVE-2026-25874 is an unsafe deserialization flaw in Hugging Face LeRobot through 0.5.1, rated 9.8. The async inference policy server and robot client call pickle.loads on data from unauthenticated gRPC channels without TLS. The record names no fixed version, so check the project's issues and pull request.
What's affected
- Package: lerobot on PyPI, by Hugging Face.
- Affected: through 0.5.1.
- Components: the async inference pipeline, in both the policy server and the robot client.
- Fixed version: not stated in the record. Follow the project's pull request 3048 and issue 3134.
How to check if you're exposed
Check which version is installed and whether you run the async inference feature:
pip show lerobot
ss -ltnp | grep -i python
The second command lists listening sockets owned by Python processes. A gRPC port that is open beyond localhost on a robot or inference host is the exposure to look for.
What to do now
- Do not expose the policy server or robot client ports to untrusted networks. Bind to localhost or a private interface.
- Use a firewall rule so only the paired machine can reach the gRPC port.
- Track the project's issue and pull request and upgrade when a patched release appears.
- Do not run the async inference feature on hosts that hold credentials or on machines connected to hardware you cannot safely stop.
- Run the processes in a container with minimal permissions.
Why it matters
The class is CWE-502, deserialization of untrusted data. Python's pickle format can carry instructions that run when loaded, so reading pickle from the network is the same as running whatever the sender chooses. The channel had no authentication and no TLS, so there was no check on who was sending.
In robotics the effect goes beyond a compromised server: the robot client side is affected too, and a machine attached to physical hardware is at risk. The fix direction is to replace pickle with a data only format and to add authentication and TLS. The record does not mark this CVE as exploited in the wild.
How to prioritise the fix
Work out whether anyone on your team uses the async inference feature. Research and robotics code gets run on laptops, lab machines and shared GPU hosts that never appear in a security review. Ask directly, and then check listening ports on those machines.
If the gRPC ports are only on localhost, the risk is much lower. If they listen on a network interface, firewall them now. Because the record gives no fixed version, follow the linked pull request and re-check when a release lands, and until then keep the feature off any machine that holds credentials.
A dependency scan answers the first question, which is whether the package is present at all. Reachability analysis answers the second, which is whether your code calls the vulnerable path. You can start with the free scan at gold.safeguard.sh/scan and then read the Gold entry for this CVE to see affected ranges.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is loading pickle ever safe?
Only for data you produced yourself and stored somewhere trusted. Never for data from a network peer you do not fully control.
Sources
Last reviewed: 19 October 2026.
