CVE-2026-115533
CVE-2026-115533
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the from_pretrained() method and related paths. When loading a policy's processor configuration from a repository, the library uses the class field within the JSON configuration to dynamically resolve and instantiate Python classes using importlib.import_module() and getattr().
| Vendor | hugging face |
| Product | lerobot |
| Published | Oct 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for hugging face lerobot
Be the first to know when new unknown vulnerabilities affecting hugging face lerobot are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Hugging Face / LeRobot
0.4.0 ≤ 0.6.1