PoC released for CVE-2026-57845, unpatched pickle deserialization RCE in Hugging Face datasets through 5.1.0
Researcher Sai Teja Erukude published full technical details and a working proof-of-concept for CVE-2026-57845, an insecure deserialization flaw (CWE-502) in the Hugging Face datasets Python library affecting every release through 5.1.0, the current version on PyPI. The deprecated but still registered pandas packaged builder hands user-supplied data files directly to pandas.read_pickle(), so a crafted pickle executes attacker code the moment a victim calls load_dataset("pandas", data_files=...) (vulncheck.com). VulnCheck assigned the CVE and coordinated disclosure, publishing its advisory on 23 October 2026 and rating the flaw 8.7 CVSS v4.0 (high) with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N; the article cites a CVSS v3 score of 8.8 (vulncheck.com). Exploitation requires user interaction and the explicit use of a deprecated builder, which limits mass exploitation, but the library is deeply embedded in ML and automation pipelines that commonly hold cloud keys, tokens and model secrets. No fixed release exists at the time of reporting and no in-the-wild exploitation has been reported.
Entenda a falha
A vulnerabilidade
CVE-2026-57845 is an insecure deserialization flaw (CWE-502) in the Hugging Face datasets Python library, in the deprecated but still registered pandas packaged builder (datasets.packaged_modules.pandas.pandas). A victim must load an attacker-supplied pickle data file through load_dataset("pandas", data_files=...), so user interaction is required. The attacker then gets code execution with the privileges of the victim process, including access to files, environment variables and secrets. All releases through 5.1.0 are affected, and no fixed release exists. VulnCheck rates it 8.7 (CVSS v4.0); the article also cites 8.8 under CVSS v3.
Como funciona
A caller asks load_dataset() for the pandas builder and points it at data files. The builder's Pandas._generate_tables() opens each file and passes it to pandas.read_pickle(). Unpickling can run code embedded in the file through a reduce method. That happens before Arrow conversion or feature validation, so the load then finishes normally and returns one row, leaving no visible sign.
Por que é vulnerável
The builder trusts user-supplied files and hands them to pandas.read_pickle() without any validation, and pickle deserialization can execute attacker-chosen code by design. The researcher notes that deprecating the builder or validating the returned DataFrame does not help, because execution occurs during unpickling. The proposed fix replaces Pandas._generate_tables() with an unconditional migration error raised before any file is opened.
Onde está
Module datasets.packaged_modules.pandas.pandas, function Pandas._generate_tables(); the proposed fix is pull request #8879 in huggingface/datasets.
Como foi descoberta
Researcher Sai Teja Erukude published the full technical details and the proof of concept. VulnCheck assigned the CVE and coordinated disclosure, publishing its advisory on 23 October 2026, more than two weeks after datasets 5.1.0 reached PyPI on 5 October. The reporter also opened the proposed fix as pull request #8879. No in-the-wild exploitation has been reported.
PoC pública
A working proof of concept is public in the researcher's repository, which holds the exploit script, saved evidence and a demo video. It shows a crafted pickle executing code when a victim loads it through the pandas builder, with the load completing normally and returning one row. Since no fixed release exists, defenders should avoid the pandas builder for untrusted data now, even though user interaction and use of a deprecated builder limit mass exploitation.
Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 01:16.
Detalhes técnicos
The vulnerable component is datasets.packaged_modules.pandas.pandas. Pandas._generate_tables() opens each data file and passes it to pandas.read_pickle() without validation, so an embedded __reduce__ payload runs with the privileges of the victim process (vulncheck.com). Execution happens before Arrow conversion or feature validation, and in the PoC the load completes normally and returns one row, leaving no visible anomaly. The researcher notes that deprecating the builder or validating the returned DataFrame does not prevent execution during unpickling. According to the advisory, a successful attack may allow reading files, environment variables and application secrets accessible to the process. The public research repository contains the exploit script, saved evidence and a demo video (github.com/SaiTeja-Erukude).
Detalhes da correção
No fixed release has shipped. A proposed fix is open as pull request #8879 in huggingface/datasets, opened by the reporter SaiTeja-Erukude and titled "Fix pickle RCE in pandas dataset builder (CVE-2026-57845)"; it replaces Pandas._generate_tables() with an unconditional migration error raised before any file is opened (github.com/huggingface/datasets). The pull request is referenced by VulnCheck as the proposed fix and is not recorded as merged into a release (vulncheck.com).
Remediação
Do not load pickle-backed datasets from untrusted sources through the pandas builder. Use the Parquet, Arrow, CSV or JSON builders instead, and for an existing DataFrame use Dataset.from_pandas() rather than a pickle file. Run dataset loading of untrusted inputs in isolated, low-privilege environments, and audit pipelines for calls to load_dataset("pandas", ...).
Linha do tempo
-
PoC released for CVE-2026-57845, unpatched pickle deserialization RCE in Hugging Face datasets through 5.1.0
ler a análise desta fonte ocultar
Researcher Sai Teja Erukude published full technical details and a working proof-of-concept for CVE-2026-57845, an insecure deserialization flaw (CWE-502) in the Hugging Face datasets Python library affecting every release through 5.1.0, the current version on PyPI. The deprecated but still registered pandas packaged builder hands user-supplied data files directly to
pandas.read_pickle(), so a crafted pickle executes attacker code the moment a victim callsload_dataset("pandas", data_files=...)(vulncheck.com). VulnCheck assigned the CVE and coordinated disclosure, publishing its advisory on 23 October 2026 and rating the flaw 8.7 CVSS v4.0 (high) with vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N; the article cites a CVSS v3 score of 8.8 (vulncheck.com). Exploitation requires user interaction and the explicit use of a deprecated builder, which limits mass exploitation, but the library is deeply embedded in ML and automation pipelines that commonly hold cloud keys, tokens and model secrets. No fixed release exists at the time of reporting and no in-the-wild exploitation has been reported.Technical Details
The vulnerable component is
datasets.packaged_modules.pandas.pandas.Pandas._generate_tables()opens each data file and passes it topandas.read_pickle()without validation, so an embedded__reduce__payload runs with the privileges of the victim process (vulncheck.com). Execution happens before Arrow conversion or feature validation, and in the PoC the load completes normally and returns one row, leaving no visible anomaly. The researcher notes that deprecating the builder or validating the returned DataFrame does not prevent execution during unpickling. According to the advisory, a successful attack may allow reading files, environment variables and application secrets accessible to the process. The public research repository contains the exploit script, saved evidence and a demo video (github.com/SaiTeja-Erukude).Fix Details
No fixed release has shipped. A proposed fix is open as pull request #8879 in
huggingface/datasets, opened by the reporter SaiTeja-Erukude and titled "Fix pickle RCE in pandas dataset builder (CVE-2026-57845)"; it replacesPandas._generate_tables()with an unconditional migration error raised before any file is opened (github.com/huggingface/datasets). The pull request is referenced by VulnCheck as the proposed fix and is not recorded as merged into a release (vulncheck.com).Remediation
Do not load pickle-backed datasets from untrusted sources through the pandas builder. Use the Parquet, Arrow, CSV or JSON builders instead, and for an existing DataFrame use
Dataset.from_pandas()rather than a pickle file. Run dataset loading of untrusted inputs in isolated, low-privilege environments, and audit pipelines for calls toload_dataset("pandas", ...).