Arbitrary Code Execution in LeRobot Library from Unknown Vendor

CVE-2026-115533

What is CVE-2026-115533?

The LeRobot library poses a security risk through arbitrary code execution due to unsafe dynamic class instantiation in the from_pretrained() method. This vulnerability arises when loading processor configurations from a repository, where the library improperly uses JSON configuration data to dynamically resolve and instantiate Python classes. By leveraging the importlib.import_module() and getattr() functions based on untrusted input, an attacker may be able to execute arbitrary code, thus compromising the system's integrity.

References