pollen-robotics vulnerabilities

Products

• reachy_mini 1
• reachy-mini-os 1

Latest pollen-robotics CVEs

Newest publication first

1. CVE-2026-53605 Reachy Mini Wireless: Local Privilege Escalation via Unrestricted sudo systemctl Grant

   Published 2026-09-30

   High·CVSS 7.8 EPSS 0.13%

   Reachy Mini ISO for Wireless contains the necessary files to build a custom Raspberry Pi OS image for the Reachy Mini Wireless robot, using pi-gen. Prior to version 0.2.4, the Reachy Mini Wireless OS image shipped with an overly broad sudoers entry granting the pollen daemon user...

2. CVE-2026-55419 Reachy Mini: Unrestricted Upload of File with Dangerous Type

   Published 2026-08-25

   Medium·CVSS 5.3 EPSS 0.48%

   Reachy Mini is an SDK for controlling Reachy Mini robots. Prior to 1.8.2, the Reachy Mini daemon exposes the /api/media/sounds/upload endpoint implemented by the upload_sound method in src/reachy_mini/daemon/app/routers/media.py without authentication, file-extension checks, cont...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.