T
Jul 15, 2026Two Critical CVEs Hit Hugging Face: TGI DoS (CVE-2026-0599) and LeRobot Unauthenticated RCE (CVE-2026-25874)
Hugging Face ecosystem under fire: CVE-2026-0599 crashes TGI servers via unbounded image fetching, while CVE-2026-25874 gives unauthenticated RCE on LeRobot via pickle deserialization. Patch now.
Jul 15, 20265 min read0 reactions0 comments