A flaw in Hugging Face’s datasets library lets a malicious pickle file run Python code when it is loaded through the library’s deprecated pandas builder. AI security researcher Sai Teja Erukude discovered and reported the issue, published a demonstration, and submitted a patch with regression tests. The patch has not been merged.
The vulnerability, CVE-2026-57845, affects datasets versions through 5.1.0, according to VulnCheck’s advisory. VulnCheck lists CVSS 4.0 at 8.7 High and CVSS 3.1 at 8.8 High, reflecting different versions of the scoring system.
An attacker would need to get someone to load a crafted pickle through the affected builder. Installing datasets or downloading a file is not enough. Erukude said he has seen no evidence of exploitation beyond his controlled test.
How the datasets pandas builder executes a pickle payload
The pandas builder takes files supplied by the caller and passes them to pandas.read_pickle() before converting the result to an Arrow table. That sequence appears in the datasets 5.1.0 source code.
Pickle is a Python format for storing objects, but deserializing a pickle can also execute code chosen by whoever created it. Pandas warns against loading pickles from untrusted sources. In the affected datasets builder, code in a malicious file runs before the returned object can be checked or converted. A valid DataFrame at the end of the process does not mean the loading step was safe.
The discovery began with automated screening of Python AI and data-science packages. Two fine-tuned language-model agents helped assess which candidate paths were reachable and worth investigating, a method described in Erukude’s published research paper. Manual review then traced caller-supplied files through the deprecated builder to read_pickle(), and testing reproduced code execution in an installed copy of datasets 5.1.0.
The builder is deprecated, but it is still present in that release. Its deprecation warning does not stop the pickle from being opened.
Which Hugging Face datasets workflows can trigger the flaw
One plausible scenario involves a researcher downloading a dataset and notebook from an external repository, then running the notebook to reproduce an experiment. If the notebook loads the supplied pickle through the pandas builder, the file can run code with the researcher’s Python process privileges. A legacy pipeline that accepts pickle files from outside parties could face the same problem. These are examples of possible exposure, not observed attacks.
The proof of concept uses load_dataset(“pandas”, data_files=…). The same table-generation method can be reached by preparing a builder created with load_dataset_builder(“pandas”, …) or by using the builder directly. In streaming mode, the file is processed when the iterable is consumed. Merely constructing a builder does not trigger the demonstrated behavior. A compatible prepared Arrow cache can also bypass the step that opens the original file.
The code runs with whatever access the loading process already has. That could include files and credentials available to the process, but the demonstration did not attempt to steal data or gain higher privileges. Nor did it show a compromise of Hugging Face’s hosted services.
Pickle proof of concept shows code execution during loading
The crafted pickle writes a harmless marker file and returns a valid DataFrame. In the test, the marker appeared while datasets loaded the file, and loading completed with the expected row. The result confirms code execution through this builder even when the dataset appears to load normally.
His test used a local file. It did not demonstrate how an attacker would deliver one to a victim. The attack would still depend on a person or application choosing to load untrusted pickle content through the affected path.
The datasets package has recorded about 1.57 billion cumulative downloads on PyPI. That figure describes the package’s reach, not the number of vulnerable systems. It does not tell us how many users employ this particular builder or accept pickle files from untrusted sources.
The proposed Hugging Face datasets patch remains open
Erukude told Daily Security Review that VulnCheck confirmed its report to Hugging Face on June 26, 2026. He said the disclosure deadline passed on October 22 without a vendor response reported to him. VulnCheck published the advisory on October 23 and credits him with the discovery.
His proposed upstream patch stops table generation before the builder opens or unpickles an input file. Instead, the builder raises an error pointing users to other ways to load data. The change would disable pickle-backed table generation for trusted files as well as untrusted ones. The accompanying tests check that pandas.read_pickle() is never called through this path.
Validation after unpickling would come too late because code may already have run. A warning or an expected filename would not solve that problem. The proposed patch still allows file resolution and downloads before the new guard is reached; it targets the unsafe deserialization call.
As of November 2, the pull request was open, and the project’s release page listed 5.1.0 as the latest release. Erukude said he had received no response from Hugging Face since public disclosure or submission of the PR. No fixed upstream release has been confirmed.
How to reduce exposure to the datasets pickle flaw
Teams should check for code that loads externally supplied files through the pandas builder, including load_dataset(“pandas”, data_files=…). They should stop using that path for untrusted pickle files.
Trusted producers can export data as Parquet, Arrow, CSV, or JSON for use with the corresponding loader. An existing DataFrame that was constructed safely can be passed to Dataset.from_pandas(). Opening an untrusted pickle to convert it to another format would expose the converter to the same risk.
If a legacy workflow cannot immediately stop using pickle, teams should limit inputs to trusted producers, check provenance and integrity, and isolate the unpickling process from sensitive files, production credentials, and unnecessary network access. These measures can limit exposure, but they cannot make a malicious pickle safe. Teams may also test and deploy the proposed patch while they wait for an upstream release.
Conclusion
CVE-2026-57845 turns a specific data-loading choice into a code-execution risk. The demonstrated path requires untrusted pickle content to reach the deprecated pandas builder; it is not triggered by installing datasets or downloading a file. Until a fix is released, teams using that builder should move to other file formats where possible and isolate any unavoidable pickle loading. A dataset that loads successfully can still have run code before it returned a row.
