News CVE-2026-25874: Hugging Face LeRobot – Unauthenticated Pickle RCE in the AsyncInference PolicyServer Jun 29, 2026 ·10 min read