PT-2026-34741 · Lerobot · Lerobot
Valentin Lobstein
·
Published
2026-04-23
·
Updated
2026-05-26
·
CVE-2026-25874
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
LeRobot versions prior to 0.6.0
Description
An unsafe deserialization issue exists in the asynchronous inference pipeline of the LeRobot robotics platform. The software uses the
pickle.loads() function to deserialize data received over unauthenticated gRPC channels without TLS in the policy server and robot client components. A network-reachable unauthenticated attacker can achieve arbitrary code execution on the server or client by sending a specially crafted pickle payload through the 'SendPolicyInstructions', 'SendObservations', or 'GetActions' gRPC calls. This flaw specifically affects the PolicyServer component, potentially allowing the attacker to execute operating system commands on the host machine, steal sensitive data such as API keys and SSH credentials, or compromise connected robots and physical systems.Recommendations
Update to version 0.6.0 once available.
As a temporary workaround, restrict network access to the PolicyServer port to trusted sources only.
Avoid using the 'SendPolicyInstructions', 'SendObservations', and 'GetActions' gRPC calls over unauthenticated and non-TLS channels.
Exploit
Fix
RCE
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Lerobot