---
id: "CVE-2026-115533"
kind: "vulnerability"
aliases: ["CVE-2026-115533"]
title: "LeRobot: loading a policy config can run attacker-chosen Python code"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["lerobot", "ml-pipelines", "package", "python", "robotics"]
not_affected_if: ["local-policies-only"]
published_at: "2026-10-26T20:17:51+00:00"
first_seen_at: "2026-10-26T20:50:17+00:00"
updated_at: "2026-10-26T20:51:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115533", "first_seen_at": "2026-10-26T20:50:17+00:00"}]
---

# LeRobot: loading a policy config can run attacker-chosen Python code

LeRobot's from_pretrained() reads the class field from a policy's processor JSON config and imports it with importlib.import_module() and getattr(). A malicious repository's config can therefore make the library import and instantiate arbitrary Python classes, which the sources say leads to arbitrary code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed LeRobot version with `pip show lerobot`
- Search your code and configs for calls to `from_pretrained()` that load policies from repositories you do not control
- unknown for the exact affected version range

## Fix

- unknown: the sources do not name a fixed version
- Until a fix is confirmed, only load policies from repositories you trust, and pin revisions

## Timeline

- 2026-10-26T20:50:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115533

## From the sources

The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the from_pretrained() method and related paths. When loading a policy's processor configuration from a repository,  the library uses the class field within the JSON configuration to dynamically resolve and instantiate Python classes using importlib.import_module() and getattr().

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_