Hugging Face Datasets: Insecure deserialization in pandas builder

Summary

Hugging Face Datasets up to and including 5.1.0 deserializes pickle files without validation in its deprecated pandas builder. An attacker who gets a victim to load a crafted pickle-backed dataset via datasets.load_dataset("pandas", data_files=...) can execute arbitrary Python code with the victim process's privileges. The CVSS 4.0 score is 8.7 (High), and user interaction is required.

Affected

• Hugging Face datasets Python library, versions 0 to 5.1.0 (per CNA record)
• Affected path: pandas packaged builder, used via datasets.load_dataset("pandas", data_files=...)

Fixed in

Unknown. A proposed fix exists (Pull Request #8879 in huggingface/datasets), but no merged or released fixed version has been confirmed.

Workaround

• Do not load data with the pandas builder from files you did not create yourself
• Load untrusted datasets only in isolated environments without credentials or sensitive data

Exploitation

• A public proof of concept is available from the reporter's repository, including a demo video.
• No evidence that the vulnerability is known to be exploited in the wild.
• Sources conflict: VulDB reports no available exploit, while PT/Vulners lists a GitHub exploit entry.

Our recommendation

• Search your code and notebooks for load_dataset calls using "pandas" and check the installed datasets version.
• Remove or avoid the pandas builder where possible; use Parquet, Arrow, CSV or JSON formats instead.
• Load third-party datasets only from trusted sources, ideally in isolated environments.
• Watch for an upstream fixed release and update datasets as soon as one is available.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  SaiTeja-Erukude/CVE-2026-57845-hf-datasets-rce

Research sources

• Proof of concept and write-up (reporter repository) github.com
• Proposed fix: Pull Request #8879 (huggingface/datasets) github.com
• VulnCheck advisory www.vulncheck.com
• Vulners NVD record (CVSS 8.8 entry) vulners.com
• VulDB entry (exploit status) vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:25.