CVE-2026-115533

Not scored yetLast modified Oct 27, 2026

Description

The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the from_pretrained() method and related paths. When loading a policy's processor configuration from a repository, the library uses the class field within the JSON configuration to dynamically resolve and instantiate Python classes using importlib.import_module() and getattr().

Metrics

No CVSS score has been published yet.

Affected software

No affected versions have been published.

Timeline

Published
Oct 26, 2026
Last modified
Oct 27, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1155344.3A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function kiCVE-2026-1155352.4A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is theCVE-2026-1155364.3A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The impacted element iCVE-2026-1155374.3A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function sCVE-2026-1155387.0Moby's overlay network driver does not restore the iptables rules for encrypted overlay networks after firewalld deletes them. Unlike other CVE-2026-1155397.7SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS identity with an intermediary manager's identity. WithMetadataForwardTLSCVE-2026-115544.3A vulnerability was determined in TOTOLINK CP450 4.1.0cu.747. This vulnerability affects unknown code of the file /etc/vsftpd.conf of the coCVE-2026-1155417.2HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in the friendship confirmation dialog. An authenticatedCVE-2026-1155468.1Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session CVE-2026-1155479.1An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. CVE-2026-1155487.2The Quttera ThreatSign – Web Malware Scanner for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_UCVE-2026-115557.5A vulnerability was identified in D-Link DGS-1100-08PD 1.00.006. This issue affects some unknown processing of the file /etc/boa.conf of the
CVE-2026-115533: Unscored | Vulnix