Live › vulnerability › CVE-2026-115533
Go to dashboardLeRobot's from_pretrained() reads the class field from a policy's processor JSON config and imports it with importlib.import_module() and getattr(). A malicious repository's config can therefore make the library import and instantiate arbitrary Python classes, which the sources say leads to arbitrary code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 20:50 UTC. All times on this page are UTC.
Teams that load robot policies with LeRobot's from_pretrained() from a model repository, especially ones they do not own or review. Systems that only use locally built or vetted policy files are less exposed. The sources do not say which versions or configurations are affected.
No product ranges from the sources yet.
pip show lerobotfrom_pretrained() that load policies from repositories you do not controlEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the from_pretrained() method and related paths. When loading a policy's processor configuration from a repository, the library uses the class field within the JSON configuration to dynamically resolve and instantiate Python classes using importlib.import_module() and getattr().
This page as .md · .json · in your agent: get_signal("CVE-2026-115533")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.