Critical RCE Vulnerability in Hugging Face LeRobot Exposes Systems to Attack

**Critical RCE in Hugging Face LeRobot (CVE-2026-25874)** — A critical unauthenticated remote code execution vulnerability with a CVSS of 9.8 was disclosed in Hugging Face's open-source LeRobot framework on 2026-04-23 and reported unpatched as of 2026-04-28; the project's broad adoption (approximately 21,500 GitHub stars) raises the potential for mass exploitation and organizations are advised to assess and mitigate exposure immediately.