Hugging Face LeRobot Vulnerability Enables Unauthenticated RCE Attacks

Cybersecuritynews •Abinaya • April 29, 2026

A critical, currently unpatched remote code execution (RCE) vulnerability has been disclosed in LeRobot, Hugging Face’s popular open-source machine learning framework for real-world robotics. Tracked as CVE-2026-25874 with a critical CVSS score of 9.3, the flaw allows unauthenticated attackers to execute arbitrary system commands on vulnerable host machines. With nearly 24,000 stars on GitHub, this […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in Hugging Face LeRobot Exposes Systems to Attack A critical remote code execution (RCE) vulnerability, tracked as CVE-2026-25874, has been identified in Hugging Face's LeRobot, an open-source robotics machine learning framework. This flaw, which has a CVSS severity score of 9.8, allows unauthenticated attackers to execute arbitrary commands on affected servers. With over 21,500 stars on GitHub, LeRobot's widespread use increases the risk of exploitation. The vulnerability was published on April 23, 2026, and remains unpatched as of April 28, 2026. Organizations using LeRobot are at significant risk of compromise if they do not take immediate action to secure their systems. Security professionals are urged to assess their environments for this vulnerability and implement mitigation strategies. The potential for mass exploitation is high given the framework's popularity in the machine learning community. 3 sources 77

Extracted Entities

Hugging Face LeRobot Vulnerability Enables Unauthenticated RCE Attacks

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)