CVE-2026-57845: Hugging Face Datasets 5.1.0 Pickle Deserialization RCE via Pandas Builder
Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed by Pandas.generatetables via pandas.readpickle() without validation, so when a victim calls datasets.loaddataset("pandas", datafiles=...), the embedded reduce payload executes code with the victim process's privileges.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Python processes using Hugging Face Datasets through version 5.1.0 are exposed when they load attacker-controlled or otherwise untrusted pickle-backed dataset files through the deprecated pandas packaged builder.
What must an attacker provide to trigger code execution?
The attacker must persuade a victim to call datasets.load_dataset("pandas", data_files=...) on a crafted pickle file. The file can contain a malicious __reduce__ payload that executes when pandas.read_pickle() is reached through Pandas._generate_tables.
Does exploitation require authentication or elevated privileges?
No authentication or pre-existing privileges are required according to the supplied severity vector. Exploitation does require user interaction: a victim must load the malicious dataset, and code runs with that victim process's privileges.
What can be done if patching is not immediately possible?
Do not use the deprecated pandas packaged builder to load pickle-backed datasets from untrusted sources. Treat pickle files as executable content and only load files whose provenance and integrity are trusted.