Description
Hugging Face Datasets before 5.2.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed by Pandas._generate_tables via pandas.read_pickle() without validation, so when a victim calls datasets.load_dataset("pandas", data_files=...), the embedded __reduce__ payload executes code with the victim process's privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| huggingface | datasets | ≤ 5.1.0 | 5.2.0 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
Sun-Wukhan/pickle-sentry ★ 0 · Nov 9, 2026
Scan code and dataset files for unsafe pickle deserialization — including the Hugging Face datasets pandas builder RCE (CVE-2026-57845). Never executes the files it inspects.
-
SaiTeja-Erukude/CVE-2026-57845-hf-datasets-rce ★ 0 · Oct 23, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- Researcher Disclosure technical-description exploit
- Release Notes release-notes
- Pull Request patch issue-tracking
- VulnCheck Advisory: Hugging Face Datasets 5.1.0 Pickle Deserialization RCE via Pandas Builder third-party-advisory