DossierENTITY

untrusted data deserialization

Coverage of untrusted data deserialization in the Nexus archive.

Earliest in view: Apr 28 · 11:18 UTCMost recent: Apr 28 · 11:18 UTC

Co-mentioned in this coverage

Recent coverage

SECURITYApr 28 · 11:18 UTCTHE HACKER NEWS
Critical Unpatched Flaw Leaves Hugging Face LeRobot Open to Unauthenticated RCE
A critical unpatched vulnerability (CVE-2026-25874) in Hugging Face's LeRobot allows unauthenticated remote code execution, posing a significant security risk. The flaw, rated CVSS 9.3, stems from untrusted data deserialization in the open-source robotics platform.