What’s Vulnerable › Vulnerabilities
CVE-2026-115533: CVE-2026-115533
- Severity: unknown
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-26 · updated 2026-10-27
Description
The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the from_pretrained() method and related paths. When loading a policy's processor configuration from a repository, the library uses the class field within the JSON configuration to dynamically resolve and instantiate Python classes using importlib.import_module() and getattr().
Affected products
- Hugging Face LeRobot: from 0.4.0 through 0.6.1
References
Get alerted when CVE-2026-115533 or the next vulnerability affects your stack