High priorityDisclosed

Advisory · CVE-2026-57845

Hugging Face Datasets can run pickle code from a crafted dataset file

Hugging Face Datasets through 5.1.0 can be made to run arbitrary Python code from a crafted pickle file loaded through the deprecated pandas builder, when a user loads it with the pandas dataset name. CVSS 3.1 8.8.

Advisory published October 23, 2026Independent summary
Vendor
Hugging Face
Product
Datasets
Identifier / CWE
CVE-2026-57845
CWE-502
Action timing
Immediate
ELI5

Explain it like I’m five

This library can open a dataset saved in a format that is really a small program in disguise, so a booby-trapped dataset file runs its hidden instructions on your machine as soon as the library opens it.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Attacker crafts a pickle dataset

    An attacker builds a dataset file backed by a pickle payload and shares it for others to load.

  2. 02Victim loads it as pandas data

    A user calls the datasets load function with the pandas builder name and the crafted file as the data source.

  3. 03Library unpickles without validation

    Per the VulnCheck advisory, the pandas builder path reads the pickle through a pandas call with no validation of its contents.

  4. 04Embedded code runs

    The payload instructions execute during loading, with the privileges of the victim process, before the user sees any data.

What happened

VulnCheck disclosed CVE-2026-57845 for Hugging Face Datasets, the widely used machine learning data library: Datasets through 5.1.0 contains an insecure deserialization vulnerability in the deprecated pandas packaged builder. Per the advisory, a pickle-backed dataset is processed through a pandas read call without validation, so when a victim loads it with the pandas builder name, the embedded payload executes code with the privileges of the victim process. The CVSS 3.1 score is 8.8 and the CVSS 4.0 score is 8.7.

A pull request in the Datasets project addresses this CVE by making the pandas builder raise a migration error before any file is opened or unpickled, which confirms the affected path in the project tracker. No fixed version is named in the NVD record, so no upgrade target is claimed here; a proposed project fix is not the same as a released fix, and teams should check the project releases for a version that states it addresses this CVE.

What to do

  1. Inventory notebooks, training jobs and data pipelines that use the Datasets library, and note where the pandas builder name is used to load files.
  2. Stop loading pickle-backed or otherwise untrusted dataset files with that builder; prefer data from sources you control, in formats that do not carry code.
  3. Treat any dataset file from a third party as untrusted input: load it only in a sandbox with no credentials and no network access until it has been checked.
  4. Review jobs that loaded third-party datasets for unexpected processes, file writes or outbound connections at load time.
  5. Watch the Datasets project releases for a version that states it addresses this CVE, and upgrade to it once it is stated; no fixed version is named in the NVD record.

Management note

Dataset sharing is routine in machine learning work, which is what makes a load-time code execution flaw in this library worth acting on before a fixed release exists. The interim control is simple and strict: no untrusted pickle-backed datasets, and no loading third-party data outside a sandbox.