---
id: "CVE-2026-57845"
kind: "vulnerability"
aliases: ["CVE-2026-57845"]
title: "Hugging Face Datasets: malicious pickle file runs Python code on load"
severity: "high"
cvss: 8.8
epss: 0.00553
exploited: false
status: "open"
category: "package"
products: [{"name": "datasets", "fixed": [], "affected": "<= 5.1.0", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["datasets", "deserialization", "hugging-face", "ml-pipelines", "package", "pickle", "python"]
not_affected_if: ["does-not-load-pandas-builder", "loads-only-trusted-data", "no-pandas-builder-use", "trusted-data-only"]
published_at: "2026-10-23T16:16:52+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57845", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:34:17+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-57845", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Hugging Face Datasets: malicious pickle file runs Python code on load

Hugging Face Datasets <= 5.1.0: the deprecated but still registered 'pandas' packaged builder passes data files to pandas.read_pickle() without validation. Loading an attacker-supplied pickle with datasets.load_dataset('pandas', data_files=...) runs arbitrary Python code as the loading process. A public PoC exists. No fixed release is confirmed; the upstream fix (PR #8879) is open and would make the builder always raise an error.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:datasets affected <= 5.1.0 fixed ?

## How to check

Run 'pip show datasets' (or 'pip list | grep datasets'): any version <= 5.1.0 is affected. Search your code, notebooks and pipelines for load_dataset("pandas" and load_dataset_builder("pandas"). Only those calls reach the unsafe path.

## Fix

No fixed release known as of 2026-10-23. Stop using load_dataset('pandas', ...) on any file you do not fully trust. Convert the data to Parquet, Arrow, CSV or JSON and load it with those builders, or use Dataset.from_pandas() for a DataFrame you already hold. Watch PR #8879 (huggingface/datasets) and upgrade once a release past 5.1.0 includes it.

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-57845
- 2026-10-23T23:34:17+00:00 analyst — CVE record, VulnCheck, researcher write-up read. Affected: all datasets <=5.1.0. No fixed release yet; upstream PR #8879 open (not merged). Builder is deprecated but still registered and reachable via load_dataset('pandas'). Public PoC from researcher; no exploitation evidence. Few posts (x count 3), none saved.
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-57845

## Documents

- [advisory] CVE Record: CVE-2026-57845 https://www.cve.org/CVERecord?id=CVE-2026-57845
- [advisory] VulnCheck: Hugging Face Datasets 5.1.0 Pickle Deserialization RCE via Pandas Builder https://www.vulncheck.com/advisories/hugging-face-datasets-pickle-deserialization-rce-via-pandas-builder
- [fix] PR #8879 Fix pickle RCE in pandas dataset builder (open) https://github.com/huggingface/datasets/pull/8879
- [poc] Researcher write-up and PoC (Sai Teja Erukude) https://github.com/SaiTeja-Erukude/CVE-2026-57845-hf-datasets-rce

## From the sources

Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed by Pandas._generate_tables via pandas.read_pickle() without validation, so when a victim calls datasets.load_dataset("pandas", data_files=...), the embedded __reduce__ payload executes code with the victim process's privileges.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_