{"schema":"threatline.record/2","record":{"id":"CVE-2026-115533","aliases":[],"summary":"CVE-2026-115533","details":"The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the from_pretrained() method and related paths. When loading a policy's processor configuration from a repository,  the library uses the class field within the JSON configuration to dynamically resolve and instantiate Python classes using importlib.import_module() and getattr().","categories":["Unclassified"],"product":"LeRobot","vendor":"Hugging Face","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115533","source_modified_at":"2026-10-26T19:38:54.907Z","fetched_at":"2026-10-26T23:45:56.352924Z","product":"LeRobot","vendor":"Hugging Face","versions":[{"status":"affected","version":"0.4.0","lessThanOrEqual":"0.6.1","versionType":"custom"}],"defaultStatus":null}],"fixed_versions":[],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-26T19:38:54.907Z","modified_at":"2026-10-26T19:38:54.907Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-115533","fetched_at":"2026-10-26T23:45:56.352924Z","source_modified_at":"2026-10-26T19:38:54.907Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://gist.github.com/mtholmquist/eba1cba80ea66997b8f7e6a839e49120"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-26T19:38:54.907Z","content_hash":"f3be4719d90f364882c45ca19efa7613af14875e0411ad957bb4209204d01f97"}}