High-Risk Vulnerability in Hugging Face Datasets Allows Remote Code Execution
Article Content
- •CVE-2026-57845 allows remote code execution via untrusted pickle files.
- •Affected versions include Hugging Face Datasets up to 5.1.0.
- •High risk for teams loading datasets from untrusted sources.
A vulnerability, CVE-2026-57845, has been identified in Hugging Face Datasets versions up to 5.1.0, enabling arbitrary Python code execution via malicious pickle files. This flaw arises from the use of the deprecated pandas packaged builder, which processes unvalidated datasets. Attackers can exploit this vulnerability by supplying a crafted dataset that executes code with the victim's privileges when loaded. Teams using the library in data science pipelines or model training jobs are particularly at risk, especially if they load datasets from untrusted sources. The vulnerability was published on October 23, 2026, and is rated with a CVSS score of 8.7, indicating high severity. Users are advised to upgrade to a patched version or disable the affected builder to mitigate risks until a fix is applied.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (4)
Following this threat?
Track CVE-2026-57845 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What versions of Hugging Face Datasets are affected?
How can I mitigate this vulnerability?
Is there any active exploitation reported?
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…