Live › vulnerability › CVE-2026-57845
Go to dashboardHugging Face Datasets <= 5.1.0: the deprecated but still registered 'pandas' packaged builder passes data files to pandas.read_pickle() without validation. Loading an attacker-supplied pickle with datasets.load_dataset('pandas', data_files=...) runs arbitrary Python code as the loading process. A public PoC exists. No fixed release is confirmed; the upstream fix (PR #8879) is open and would make the builder always raise an error.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| datasets | pypi | <= 5.1.0 | – |
pip show datasets (or pip list | grep datasets): any version <= 5.1.0 is affectedpandas, ...) on any file you do not fully trust5.1.0 includes itEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed by Pandas._generate_tables via pandas.read_pickle() without validation, so when a victim calls datasets.load_dataset("pandas", data_files=...), the embedded reduce payload executes code with the victim process's privileges.
This page as .md · .json · in your agent: get_signal("CVE-2026-57845")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.