Loading story…
Critical deserialization flaws were disclosed in multiple AI and robotics components, allowing attackers to execute arbitrary code by sending crafted pickle payloads to exposed services. In Hugging Face’s LeRobot 0.4.3, CVE-2026-25874 affects the async inference PolicyServer, where the SendPolicyInstructions and SendObservations gRPC handlers call pickle.loads() on attacker-controlled bytes before validation. The service is exposed over an insecure gRPC port with no TLS or authentication, making network-accessible deployments vulnerable to unauthenticated remote code execution; the issue was rated CVSS 9.8 and no fix was available at disclosure. A separate flaw, CVE-2026-26210, was reported in ktransformers’ legacy balance_serve backend, where a ZeroMQ ROUTER socket bound on all interfaces forwards untrusted messages to worker threads that also invoke pickle.loads() without authentication, enabling unauthenticated remote code execution and prompting a fix PR.
Track how attackers are adapting to this technology.
9 events from the most recent confirmed update back to the earliest known activity.
A new report said CVE-2026-25874 in Hugging Face LeRobot remained unpatched as of 2026-04-28, but a fix was planned for release in version 0.6.0. The flaw affects LeRobot 0.4.3's PolicyServer and can enable unauthenticated remote code execution via unsafe pickle deserialization over gRPC.
The LeRobot report states that CVE-2026-25874 was published on 2026-04-23. At that time, the report said no vendor fix had yet been issued.
A pull request to fix the ktransformers balance_serve pickle deserialization issue was submitted. The report indicates this occurred after disclosure of CVE-2026-26210.
A public report disclosed CVE-2026-26210 as a critical CVSS 9.8 vulnerability in ktransformers' legacy ZMQ scheduler, warning that attackers could identify the dynamic port from logs or scanning and exploit documented host-network Docker deployments. The report recommended replacing pickle, restricting network binding, and adding authentication.
A public report detailed CVE-2026-25874, assigning the LeRobot flaw a CVSS 9.8 score and demonstrating successful code execution against a stock installation using malicious pickle payloads sent through both vulnerable gRPC methods. The report noted the service was exposed over insecure gRPC with no TLS or authentication.
A critical remote code execution flaw was disclosed in kvcache-ai/ktransformers' legacy balance_serve backend, where a ZeroMQ ROUTER socket exposed on all interfaces forwards untrusted messages to worker threads that call pickle.loads() without authentication or validation. The issue affects deployments using --backend_type balance_serve, while the newer SGLang-based deployment is not affected.
The LeRobot report states that disclosure attempts were made in late 2025 and early 2026 before public publication. No fix had been issued at the time of the report.
Hugging Face's LeRobot 0.4.3 async inference PolicyServer was identified as vulnerable because two gRPC handlers in policy_server.py call pickle.loads() on attacker-controlled bytes before type validation. A network-accessible deployment could allow unauthenticated remote code execution through SendPolicyInstructions and SendObservations.
Microsoft's TensorWatch 0.9.1 opens a local ZMQ REP socket on 127.0.0.1:41459 when tw.Watcher() is called and deserializes incoming messages with pickle.loads() before validation, enabling local code execution by another user on the same machine. The issue is particularly relevant on shared systems and host-networked containers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
6 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethehackernews.com
Open sourceresecurity.com
Open sourcechocapikk.com
Open sourcechocapikk.com
Open sourcechocapikk.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two AI infrastructure projects, **KTransformers** and **LeRobot**, were found vulnerable to unauthenticated remote code execution caused by unsafe deserialization of attacker-controlled data with `pickle.loads()`. **KTransformers** through version `0.5.3` is affected in its `balance_serve` backend mode, where the scheduler RPC server binds a ZeroMQ `ROUTER` socket to all interfaces without authentication and processes untrusted messages, allowing an attacker to send a crafted pickle payload and execute arbitrary code with the privileges of the `ktransformers` process. The issue was tracked as `CVE-2026-26210`, mapped to **CWE-502**, and assigned a **CVSS v3.1** score vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. **LeRobot** through version `0.5.1` was similarly exposed through its async inference pipeline, where policy server and robot client components deserialize data received over unauthenticated gRPC channels without TLS. A network-reachable attacker can trigger code execution on either side by sending crafted payloads through the `SendPolicyInstructions`, `SendObservations`, or `GetActions` gRPC calls. That flaw, tracked as `CVE-2026-25874`, also carries a **CWE-502** classification and a **CVSS v4.0** rating reflecting low-complexity network exploitation with no privileges or user interaction and high impact to confidentiality, integrity, and availability. Public references for both issues include technical write-ups, GitHub remediation activity, and VulnCheck advisories.
Jun 29, 2026
A critical vulnerability in **kvcache-ai ktransformers** exposed the `balance_serve` scheduler to unauthenticated remote code execution through unsafe Python pickle deserialization on a ZeroMQ ROUTER socket. The flaw, tracked as **`CVE-2026-63767`** and **`GHSA-83vp-v6wg-x93x`**, affects versions through **`0.6.3`**. The vulnerable `SchedulerServer` bound its RPC socket to all interfaces using `tcp://*`, then passed incoming messages directly to `pickle.loads()`, allowing any reachable host to send a crafted payload with a malicious `__reduce__` method and execute arbitrary shell commands as the server process. The issue was documented in a GitHub security report that validated end-to-end code execution and noted that the scheduler port is auto-assigned, requiring discovery before exploitation. Maintainers remediated the exposure in commit **`def0f9313d6e063b5c5ccdfa1f6707f7a40dfdca`**, changing the bind address to `tcp://127.0.0.1` in both affected `sched_rpc.py` paths so the scheduler is reachable only over localhost, which matches the intended `SchedulerClient` design. The vulnerability is classified as **`CWE-502`** and carries a **CVSS 3.1** vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, reflecting high risk to confidentiality, integrity, and availability.
Jul 21, 2026
Multiple high-severity deserialization vulnerabilities have been identified in widely used AI and analytics frameworks, including NVIDIA Isaac Lab, MooreThreads torch_musa, and NVIDIA Merlin components. These flaws allow attackers to exploit unsafe deserialization processes, potentially leading to remote code execution or denial-of-service conditions on affected systems. In the case of MooreThreads torch_musa, the vulnerability arises from the use of `pickle.load()` on user-controlled files without validation, enabling arbitrary code execution with the privileges of the victim process. Similarly, NVIDIA Isaac Lab and Merlin frameworks are affected by deserialization issues that could be exploited remotely, with Merlin's NVTabular and Transformers4Rec components specifically highlighted for their susceptibility to code execution and data tampering attacks. Security advisories urge immediate patching, as these vulnerabilities are remotely exploitable and pose significant risks to enterprise environments. The affected products span various versions, and organizations using these frameworks are advised to review vendor guidance and apply available security updates to mitigate the threat. The vulnerabilities have been assigned high or critical CVSS scores, underscoring the urgency for remediation to prevent potential exploitation in production environments.
Jun 29, 2026