CVE-2026-25874

creationtimestamp| type| source ---|---|--- 2026-04-23 21:26:14+00:00| published-proof-of-concept| Telegram/LhBAsLXZuywUMfmIXbSwPnWzjb6RJaoGfmWe6gs8QchtB8o 2026-04-28 06:33:02+00:00| seen| https://bsky.app/profile/blackhatnews.tokyo/post/3mkjxni7pjj2w 2026-04-28 09:18:00+00:00| seen|...

CVE-2026-25874 LeRobot Unsafe Deserialization Remote Code Execution via gRPC

LeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads is used to deserialize data received over unauthenticated gRPC channels without TLS in the policy server and robot client components. An unauthenticated network-reachable...