{"id":"CVE-2026-57845","kind":"vulnerability","aliases":["CVE-2026-57845"],"related":[],"title":"Hugging Face Datasets: malicious pickle file runs Python code on load","description":"Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed by Pandas._generate_tables via pandas.read_pickle() without validation, so when a victim calls datasets.load_dataset(\"pandas\", data_files=...), the embedded __reduce__ payload executes code with the victim process's privileges.","summary":"Hugging Face Datasets <= 5.1.0: the deprecated but still registered 'pandas' packaged builder passes data files to pandas.read_pickle() without validation. Loading an attacker-supplied pickle with datasets.load_dataset('pandas', data_files=...) runs arbitrary Python code as the loading process. A public PoC exists. No fixed release is confirmed; the upstream fix (PR #8879) is open and would make the builder always raise an error.","severity":"high","cvss":8.8,"epss":0.00553,"exploited":false,"exploited_at":null,"products":[{"name":"datasets","fixed":[],"affected":"<= 5.1.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["datasets","deserialization","hugging-face","ml-pipelines","package","pickle","python"],"not_affected_if":["does-not-load-pandas-builder","loads-only-trusted-data","no-pandas-builder-use","trusted-data-only"],"how_to_check":"Run 'pip show datasets' (or 'pip list | grep datasets'): any version <= 5.1.0 is affected. Search your code, notebooks and pipelines for load_dataset(\"pandas\" and load_dataset_builder(\"pandas\"). Only those calls reach the unsafe path.","fix":"No fixed release known as of 2026-10-23. Stop using load_dataset('pandas', ...) on any file you do not fully trust. Convert the data to Parquet, Arrow, CSV or JSON and load it with those builders, or use Dataset.from_pandas() for a DataFrame you already hold. Watch PR #8879 (huggingface/datasets) and upgrade once a release past 5.1.0 includes it.","status":"open","published_at":"2026-10-23T16:16:52+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-23T22:30:57+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:30:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Hugging Face Datasets: malicious pickle file runs Python code on load","impact":"high","summary":"Hugging Face Datasets through 5.1.0 passes data files to pandas.read_pickle() in its deprecated pandas builder without validation. A crafted pickle file loaded with datasets.load_dataset(\"pandas\", ...) lets an attacker run arbitrary Python code with the victim process's privileges.","category":"package","who_cares":["python","datasets","hugging-face","ml-pipelines"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs arbitrary Python code as the victim process user.","analyst_note":"Confirm fixed version beyond 5.1.0 and check whether the pandas builder is deprecated-only or still reachable at NVD link https://nvd.nist.gov/vuln/detail/CVE-2026-57845.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["does-not-load-pandas-builder","loads-only-trusted-data"],"user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000509,"input_tokens":3013,"output_tokens":415,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm fixed version beyond 5.1.0 and check whether the pandas builder is deprecated-only or still reachable at NVD link https://nvd.nist.gov/vuln/detail/CVE-2026-57845.","search":"'-2026':13A,16A '-57845':14A,17A '5.1.0':33B,99C '8879':83B 'allow':106C 'alway':91B 'arbitrari':63B,110C 'attack':53B,107C,126C 'attacker-suppli':52B 'back':132C 'builder':41B,90B,125C 'call':148C 'code':9A,65B,112C,159C 'confirm':78B 'contain':100C 'craft':114C 'cve':12A,15A 'data':43B,60B,152C 'dataset':3A,19B,32B,58B,97C,133C,150C 'datasets':18A 'datasets.load':57B,149C 'deprec':35B,122C 'deseri':20B,103C 'embed':155C 'error':94B 'execut':109C,158C 'exist':73B 'face':2A,23B,31B,96C 'file':6A,44B,61B,118C,153C 'fix':75B,81B 'hug':1A,22B,30B,95C 'hugging-fac':21B 'insecur':102C 'load':11A,50B,68B,119C 'make':88B 'malici':4A,116C 'ml':25B 'ml-pipelin':24B 'open':85B 'packag':27B,40B,124C 'panda':39B,59B,123C,151C 'pandas._generate_tables':138C 'pandas.read':46B,140C 'pass':42B 'payload':157C 'pickl':5A,28B,47B,55B,117C,131C,141C 'pickle-back':130C 'pipelin':26B 'poc':72B 'pr':82B 'privileg':165C 'process':69B,136C,163C 'public':71B 'python':8A,29B,64B,111C 'rais':92B 'reduc':156C 'regist':38B 'releas':76B 'run':7A,62B 'still':37B 'suppli':54B,128C 'upstream':80B 'valid':49B,143C 'via':139C 'victim':147C,162C 'vulner':104C 'without':48B,142C 'would':87B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T16:16:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-57845","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57845","severity":null,"published_at":"2026-10-23T16:16:52+00:00","modified_at":"2026-10-23T19:45:03+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-57845:472","url":null,"severity":null,"published_at":"2026-10-23T23:34:17+00:00","modified_at":"2026-10-23T23:34:17+00:00","first_seen_at":"2026-10-23T23:34:17+00:00","fetched_at":"2026-10-23T23:34:17+00:00","note":"CVE record, VulnCheck, researcher write-up read. Affected: all datasets <=5.1.0. No fixed release yet; upstream PR #8879 open (not merged). Builder is deprecated but still registered and reachable via load_dataset('pandas'). Public PoC from researcher; no exploitation evidence. Few posts (x count 3), none saved."},{"source":"epss","external_id":"CVE-2026-57845","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57845","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":2045,"url":"https://www.cve.org/CVERecord?id=CVE-2026-57845","title":"CVE Record: CVE-2026-57845","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2041,"url":"https://www.vulncheck.com/advisories/hugging-face-datasets-pickle-deserialization-rce-via-pandas-builder","title":"VulnCheck: Hugging Face Datasets 5.1.0 Pickle Deserialization RCE via Pandas Builder","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2042,"url":"https://github.com/huggingface/datasets/pull/8879","title":"PR #8879 Fix pickle RCE in pandas dataset builder (open)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":2043,"url":"https://github.com/SaiTeja-Erukude/CVE-2026-57845-hf-datasets-rce","title":"Researcher write-up and PoC (Sai Teja Erukude)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}