Back github.com

Datasets Pull 8879

github.com • October 24, 2026

Addresses CVE-2026-57845 , arbitrary code execution through pickle deserialization in the pandas dataset builder.

Replaces Pandas._generate_tables() with an unconditional migration error before file opening or unpickling. Builder construction and compatible prepared Arrow cache reuse remain supported. File resolution and downloads may occur before rejection; streaming loads fail when iterated.

Updates regression tests and remediation documentation.

Validation: all 25 focused pandas/Parquet tests pass, along with lint and formatting checks.

Technical write-up and PoC:

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

High-Risk Vulnerability in Hugging Face Datasets Allows Remote Code Execution A vulnerability, CVE-2026-57845, has been identified in Hugging Face Datasets versions up to 5.1.0, enabling arbitrary Python code execution via malicious pickle files. This flaw arises from the use of the deprecated pandas packaged builder, which processes unvalidated datasets. Attackers can exploit this vulnerability by supplying a crafted dataset that executes code with the victim's privileges when loaded. Teams using the library in data science pipelines or model training jobs are particularly at risk, especially if they load datasets from untrusted sources. The vulnerability was published on October 23, 2026, and is rated with a CVSS score of 8.7, indicating high severity. Users are advised to upgrade to a patched version or disable the affected builder to mitigate risks until a fix is applied. 1 sources 65

Extracted Entities

Datasets Pull 8879

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)

Tools (1)