CVE-2026-115533
Description
A flaw was found in LeRobot. When loading a policy processor configuration from a repository, the library dynamically resolves and instantiates classes specified within the configuration file without proper validation. An attacker who provides a crafted configuration file can exploit this flaw to achieve arbitrary code execution on the system loading the model.
Statement
Red Hat has evaluated this vulnerability as having an Important severity because successful exploitation allows arbitrary code execution with the permissions of the application, presenting a high risk to system confidentiality, integrity, and availability. While the flaw requires a user or service to load an untrusted model configuration, the severity is classified as Important rather than Moderate due to the unconstrained execution blast radius once triggered. This component is not included in standard Red Hat Enterprise Linux installations, limiting exposure primarily to specialized machine learning environments that ingest unverified external model artifacts.
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability,Other
Technical Impact: Execute Unauthorized Code or Commands; Alter Execution Logic
The attacker might be able to execute code that is not directly accessible to the attacker. Alternately, the attacker could call unexpected code in the wrong place or the wrong time, possibly modifying critical system state.
Availability,Other
Technical Impact: DoS: Crash, Exit, or Restart; Other
The attacker might be able to use reflection to call the wrong code, possibly with unexpected arguments that violate the API (CWE-227). This could cause the product to exit or hang.
Confidentiality
Technical Impact: Read Application Data
By causing the wrong code to be invoked, the attacker might be able to trigger a runtime error that leaks sensitive information in the error message, such as CWE-536.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
