CVE-2026-57845: HF Datasets pickle deserialization

CISO Take

Hugging Face Datasets through 5.1.0 unsafely deserializes pickle files in its deprecated pandas builder, so loading an attacker-supplied dataset with datasets.load_dataset("pandas", data_files=...) runs arbitrary Python code with the victim process's privileges. The CVSS 8.8 score reflects network delivery, low complexity and no privileges, with the only barrier being that a user or pipeline must load the malicious file. No EPSS score, KEV listing or SSVC decision exists yet, but a public proof-of-concept repository is referenced and the technique (a __reduce__ payload) is trivial, so weaponization risk is real even though no scanner template is available. Datasets sits at the center of training and evaluation pipelines that often hold cloud credentials, GPUs and proprietary data, so a single compromised load can become a pivot into ML infrastructure. Upgrade past the fixed release referenced in huggingface/datasets PR 8879, stop using the "pandas" builder on any non-trusted data, and audit pipelines for pickle-backed dataset sources.

Sources:NVDVulnCheckGitHub (huggingface/datasets PR 8879)ATLAS

What is the risk?

High. Exploitation needs no privileges and low complexity, but requires user interaction (loading a malicious dataset). Public PoC material is referenced, EPSS is not yet available and there is no KEV listing or known in-the-wild exploitation. Exposure is highest in organizations that pull community datasets from Hugging Face Hub or shared storage, or accept user-supplied datasets in automated pipelines. Impact is full compromise of confidentiality, integrity and availability of the process running the load.

How does the attack unfold?

Dataset Staging

Attacker crafts a pickle file with a __reduce__ payload and distributes it as a legitimate dataset.

AML.T0019

User Execution

Victim or pipeline calls load_dataset("pandas", data_files=...) on the malicious file.

AML.T0011.000

Code Execution

pandas.read_pickle deserializes the payload and runs arbitrary Python with the process's privileges.

AML.T0050

Impact

Attacker steals credentials, data and model artifacts and pivots into ML infrastructure.

AML.T0025

Dataset Staging

Attacker crafts a pickle file with a __reduce__ payload and distributes it as a legitimate dataset.

AML.T0019

User Execution

Victim or pipeline calls load_dataset("pandas", data_files=...) on the malicious file.

AML.T0011.000

Code Execution

pandas.read_pickle deserializes the payload and runs arbitrary Python with the process's privileges.

AML.T0050

Impact

Attacker steals credentials, data and model artifacts and pivots into ML infrastructure.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
HF Datasets	pip	—	No patch
22.1KOpenSSF 6.22.7K dependentsPushed 8d ago81% patched~23d to patchFull package profile →

Do you use HF Datasets? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 46% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade Hugging Face Datasets to a version containing the fix from huggingface/datasets PR 8879 once released, or apply the patch. 2) Do not use the deprecated "pandas" packaged builder; convert data to safe formats such as Parquet, CSV, JSON or Arrow. 3) Only load datasets from trusted, pinned and hash-verified sources; pin revisions on Hub datasets. 4) Run data loading in sandboxed, least-privilege containers with no ambient cloud credentials and restricted egress. 5) Scan pickle files with picklescan or fickling before use. 6) Detect by grepping code and notebooks for load_dataset("pandas"...) and monitoring for unexpected child processes or outbound connections from training jobs.

How is it classified?

Code ExecutionSupply ChainFrameworkTraining DataAML.T0010.002- Data AML.T0011.000- Unsafe AI Artifacts AML.T0019- Publish Poisoned Datasets AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.4-Quality of data for AI systems

NIST AI RMF

MAP 4.1-Risks of third-party software and data are mapped

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-57845?

Hugging Face Datasets through 5.1.0 unsafely deserializes pickle files in its deprecated pandas builder, so loading an attacker-supplied dataset with datasets.load_dataset("pandas", data_files=...) runs arbitrary Python code with the victim process's privileges. The CVSS 8.8 score reflects network delivery, low complexity and no privileges, with the only barrier being that a user or pipeline must load the malicious file. No EPSS score, KEV listing or SSVC decision exists yet, but a public proof-of-concept repository is referenced and the technique (a __reduce__ payload) is trivial, so weaponization risk is real even though no scanner template is available. Datasets sits at the center of training and evaluation pipelines that often hold cloud credentials, GPUs and proprietary data, so a single compromised load can become a pivot into ML infrastructure. Upgrade past the fixed release referenced in huggingface/datasets PR 8879, stop using the "pandas" builder on any non-trusted data, and audit pipelines for pickle-backed dataset sources.

Is CVE-2026-57845 actively exploited?

No confirmed active exploitation of CVE-2026-57845 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-57845?

1) Upgrade Hugging Face Datasets to a version containing the fix from huggingface/datasets PR 8879 once released, or apply the patch. 2) Do not use the deprecated "pandas" packaged builder; convert data to safe formats such as Parquet, CSV, JSON or Arrow. 3) Only load datasets from trusted, pinned and hash-verified sources; pin revisions on Hub datasets. 4) Run data loading in sandboxed, least-privilege containers with no ambient cloud credentials and restricted egress. 5) Scan pickle files with picklescan or fickling before use. 6) Detect by grepping code and notebooks for load_dataset("pandas"...) and monitoring for unexpected child processes or outbound connections from training jobs.

What systems are affected by CVE-2026-57845?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, fine-tuning pipelines, model evaluation harnesses, data preparation / ETL pipelines, Jupyter notebook environments.

What is the CVSS score for CVE-2026-57845?

CVE-2026-57845 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.55%.

What is the AI security impact?

Affected AI Architectures

training pipelinesfine-tuning pipelinesmodel evaluation harnessesdata preparation / ETL pipelinesJupyter notebook environments

MITRE ATLAS Techniques

AML.T0010.002Data

AML.T0011.000Unsafe AI Artifacts

AML.T0019Publish Poisoned Datasets

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.7.4

NIST AI RMF: MAP 4.1

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed by Pandas._generate_tables via pandas.read_pickle() without validation, so when a victim calls datasets.load_dataset("pandas", data_files=...), the embedded __reduce__ payload executes code with the victim process's privileges.

Exploitation Scenario

An attacker publishes a dataset repository on a public hub or shares a file on a collaboration drive containing a pickle with a __reduce__ payload, presented as a useful benchmark or fine-tuning dataset. A data scientist or automated pipeline follows a tutorial calling datasets.load_dataset("pandas", data_files="poisoned.pkl"). Pandas read_pickle deserializes the file and executes the payload, launching a reverse shell or stealing cloud keys and Hugging Face tokens from the training node. The attacker then moves laterally to the model registry, storage buckets and GPU cluster, and may tamper with models or datasets.

Weaknesses (CWE)

CWE-502Deserialization of Untrusted DataPrimary CWE-502Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.