CVE Alert: CVE-2026-57845 – huggingface

Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed by Pandas._generate_tables via pandas.read_pickle() without validation, so when a victim calls datasets.load_dataset("pandas", data_files=…), the embedded __reduce__ payload executes code with the victim process’s privileges.

**Risk verdict:** High risk for teams that load externally supplied datasets; prioritise according to exposure because the available data does not establish KEV listing or active exploitation.

**Why this matters:** A crafted dataset can turn a routine data-loading step into code execution within the process handling it, potentially exposing credentials, training data and other accessible files. Attackers could also alter data or disrupt a pipeline, with downstream consequences for model outputs and production services.

**Most likely attack path:** An attacker supplies or substitutes a malicious dataset, and a user or automated workflow loads it through the affected builder. Network reachability and low attack complexity reduce barriers, but user interaction is required; no prior privileges are indicated, and the impact is confined to the vulnerable process’s security scope.

**Who is most exposed:** Teams using the library in notebooks, data-science pipelines, model-training jobs or services that ingest datasets from external contributors are most at risk. Exposure is lower where datasets are trusted, reviewed and loaded in isolated environments.

Review job logs and code for use of the pandas builder and dataset-loading calls.

Alert on unexpected Python child processes, network connections or file writes from data-processing jobs.

Audit dataset provenance and recent changes to files passed into ingestion workflows.

Mitigation and prioritisation

Upgrade to a vendor-fixed release; verify the fix before restoring affected ingestion workflows.

Until patched, disable the affected builder and reject untrusted pickle-backed inputs.

Load datasets in isolated, least-privileged environments; rotate credentials potentially accessible to exposed jobs.

KEV and EPSS values are not provided; if KEV is confirmed or EPSS is at least 0.5, treat as priority 1.

Test the change against representative pipelines and coordinate deployment with data-platform owners.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.