Arbitrary Code Execution in LeRobot via Unsafe Dynamic Class Instantiation

Executive Summary

CVE-2026-115533 is a high-severity vulnerability in Hugging Face's LeRobot library (versions 0.4.0 through 0.6.1) that allows remote code execution (RCE). The issue occurs because the library dynamically imports and instantiates classes specified in processor configuration files without proper validation. An attacker can exploit this by publishing a malicious repository with a crafted configuration file that executes arbitrary commands when the pipeline is loaded.

The vulnerability operates through the default policy-loading path and does not require special flags. The root cause is in the _resolve_step_class function, which uses importlib.import_module() and getattr() without an allowlist, followed by instantiation with attacker-controlled arguments.

Useful 0 Not Useful 0

Detection Guidance

Check for suspicious processor configuration files (policy_preprocessor.json or policy_postprocessor.json) in LeRobot policy directories. Inspect JSON files for a 'class' field pointing to dangerous modules like subprocess.Popen. Monitor for unexpected subprocess calls or network connections during policy loading.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to execute arbitrary code in the context of your process when loading a policy from an untrusted repository. This could lead to data theft, system compromise, or further network infiltration. The impact is limited to the permissions of the loading user.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data protection requirements under GDPR (e.g., unauthorized processing of personal data) and HIPAA (e.g., unauthorized access to protected health information). Organizations using LeRobot may face compliance breaches if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Avoid loading policies from untrusted repositories. Pin exact revisions of trusted repositories. Apply the community patch PR #4285 locally if available. Run policy loading in a sandboxed environment to limit impact. Disable dynamic class instantiation if possible.

Useful 0 Not Useful 0