CVE-2026-96455

The Reachy Mini daemon is vulnerable to unauthenticated remote code execution due to a missing authentication check on its app installation endpoint (POST /apps/install ). An attacker on the same local network can exploit this by providing a body that names a public Hugging Face Space. The daemon...