Hugging Face LeRobot Flaw Opens Door to Remote Code Execution Attacks

Gbhackers •Divya • April 28, 2026

A critical remote code execution (RCE) vulnerability has been uncovered in Hugging Face’s LeRobot, a popular open-source robotics machine learning framework. Tracked as CVE-2026-25874, the flaw carries a maximum CVSS severity score of 9.8 and allows unauthenticated attackers to execute arbitrary system commands on affected servers. With over 21,500 stars on GitHub, LeRobot’s widespread adoption […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in Hugging Face LeRobot Exposes Systems to Attack A critical remote code execution (RCE) vulnerability, tracked as CVE-2026-25874, has been identified in Hugging Face's LeRobot, an open-source robotics machine learning framework. This flaw, which has a CVSS severity score of 9.8, allows unauthenticated attackers to execute arbitrary commands on affected servers. With over 21,500 stars on GitHub, LeRobot's widespread use increases the risk of exploitation. The vulnerability was published on April 23, 2026, and remains unpatched as of April 28, 2026. Organizations using LeRobot are at significant risk of compromise if they do not take immediate action to secure their systems. Security professionals are urged to assess their environments for this vulnerability and implement mitigation strategies. The potential for mass exploitation is high given the framework's popularity in the machine learning community. 3 sources 77

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (1)

CVE-2026-25874