{"id":"CVE-2026-115533","kind":"vulnerability","aliases":["CVE-2026-115533"],"related":[],"title":"LeRobot: loading a policy config can run attacker-chosen Python code","description":"The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the from_pretrained() method and related paths. When loading a policy's processor configuration from a repository,  the library uses the class field within the JSON configuration to dynamically resolve and instantiate Python classes using importlib.import_module() and getattr().","summary":"LeRobot's from_pretrained() reads the class field from a policy's processor JSON config and imports it with importlib.import_module() and getattr(). A malicious repository's config can therefore make the library import and instantiate arbitrary Python classes, which the sources say leads to arbitrary code execution.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["lerobot","ml-pipelines","package","python","robotics"],"not_affected_if":["local-policies-only"],"how_to_check":"- Check the installed LeRobot version with `pip show lerobot`\n- Search your code and configs for calls to `from_pretrained()` that load policies from repositories you do not control\n- unknown for the exact affected version range","fix":"- unknown: the sources do not name a fixed version\n- Until a fix is confirmed, only load policies from repositories you trust, and pin revisions","status":"open","published_at":"2026-10-26T20:17:51+00:00","first_seen_at":"2026-10-26T20:50:17+00:00","triaged_at":"2026-10-26T20:51:58+00:00","updated_at":"2026-10-26T20:51:58+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T20:51:58Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a fixed version\n- Until a fix is confirmed, only load policies from repositories you trust, and pin revisions","reach":"unknown","title":"LeRobot: loading a policy config can run attacker-chosen Python code","impact":"high","summary":"LeRobot's from_pretrained() reads the class field from a policy's processor JSON config and imports it with importlib.import_module() and getattr(). A malicious repository's config can therefore make the library import and instantiate arbitrary Python classes, which the sources say leads to arbitrary code execution.","category":"package","nicknames":[],"who_cares":["python","lerobot","robotics","ml-pipelines"],"confidence":0.5,"needs_auth":"unknown","worst_case":"code runs on the machine loading the policy","analyst_note":"Find the affected version range and fixed release in the NVD entry or the LeRobot repository advisory, and confirm whether loading is attacker-triggerable from a remote repo.","how_to_check":"- Check the installed LeRobot version with `pip show lerobot`\n- Search your code and configs for calls to `from_pretrained()` that load policies from repositories you do not control\n- unknown for the exact affected version range","needs_analyst":true,"not_affected_if":["local-policies-only"],"who_is_affected":"Teams that load robot policies with LeRobot's from_pretrained() from a model repository, especially ones they do not own or review. Systems that only use locally built or vetted policy files are less exposed. The sources do not say which versions or configurations are affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00062,"input_tokens":3326,"output_tokens":575,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115533':15A,18A '-2026':14A,17A 'arbitrari':62B,71B,80C 'attack':9A 'attacker-chosen':8A 'chosen':10A 'class':32B,64B,86C,110C,122C 'code':12A,72B,81C 'config':5A,40B,53B 'configur':102C,115C 'cve':13A,16A 'dynam':85C,117C 'execut':73B,82C 'field':33B,111C 'getattr':48B,127C 'import':42B,59B 'importlib.import':45B,124C 'instanti':61B,87C,120C 'json':39B,114C 'lead':69B 'lerobot':1A,19B,26B,75C 'librari':58B,76C,107C 'load':2A,97C 'make':56B 'malici':50B 'method':92C 'ml':21B 'ml-pipelin':20B 'modul':46B,125C 'packag':23B 'path':95C 'pipelin':22B 'polici':4A,36B,99C 'pretrain':29B,91C 'processor':38B,101C 'python':11A,24B,63B,121C 'read':30B 'relat':94C 'repositori':51B,105C 'resolv':118C 'robot':25B 'run':7A 'say':68B 'sourc':67B 'therefor':55B 'unsaf':84C 'use':108C,123C 'via':83C 'vulner':78C 'within':112C","nicknames":[],"mitigations":[],"who_affected":"Teams that load robot policies with LeRobot's from_pretrained() from a model repository, especially ones they do not own or review. Systems that only use locally built or vetted policy files are less exposed. The sources do not say which versions or configurations are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T20:17:51+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115533","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115533","severity":null,"published_at":"2026-10-26T20:17:51+00:00","modified_at":"2026-10-26T20:17:51+00:00","first_seen_at":"2026-10-26T20:50:17+00:00","fetched_at":"2026-10-26T20:50:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}