https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 05:20:36 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-06131 bdu:2026-06131 https://cve.radiocsirt.org/vuln/bdu:2026-06131 https://cve.radiocsirt.org/vuln/euvd-2026-336596 EUVD-2026-336596 https://cve.radiocsirt.org/vuln/euvd-2026-336596 https://cve.radiocsirt.org/vuln/fkie_cve-2026-25874 <p>LeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads() is used to deserialize data received over unauthenticated gRPC channels without TLS in the policy server and robot client components. An unauthenticated network-reachable attacker can achieve arbitrary code execution on the server or client by sending a crafted pickle payload through the SendPolicyInstructions, SendObservations, or GetActions gRPC calls.</p> <p>LeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads() is used to deserialize data received over unauthenticated gRPC channels without TLS in the policy server and robot client components. An unauthenticated network-reachable attacker can achieve arbitrary code execution on the server or client by sending a crafted pickle payload through the SendPolicyInstructions, SendObservations, or GetActions gRPC calls.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-25874 https://cve.radiocsirt.org/vuln/ghsa-f7vj-73pm-m822 <p>LeRobot contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads() is used to deserialize data received over unauthenticated gRPC channels without TLS in the policy server and robot client components. An unauthenticated network-reachable attacker can achieve arbitrary code execution on the server or client by sending a crafted pickle payload through the SendPolicyInstructions, SendObservations, or GetActions gRPC calls.</p> <p>LeRobot contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads() is used to deserialize data received over unauthenticated gRPC channels without TLS in the policy server and robot client components. An unauthenticated network-reachable attacker can achieve arbitrary code execution on the server or client by sending a crafted pickle payload through the SendPolicyInstructions, SendObservations, or GetActions gRPC calls.</p> https://cve.radiocsirt.org/vuln/ghsa-f7vj-73pm-m822