A researcher has published full details and a working proof-of-concept for CVE-2026-57845, a remote code execution flaw in the Hugging Face datasets library rated CVSS 8.8. The vulnerability affects all releases up to and including 5.1.0, and no fixed release exists.
How the Pandas Builder Runs Attacker Code Through read_pickle
Researcher Sai Teja Erukude published the technical write-up. The flaw lies in a deprecated but still registered “pandas” builder in the library. The builder passes user-supplied files to pandas.read_pickle(), and a crafted pickle file executes Python code at load time. That execution happens before Arrow conversion or feature validation, so none of the library’s checks on dataset contents have a chance to intervene.
Python’s pickle format is able to run code during deserialization, which is why loading pickles from untrusted sources is widely treated as unsafe. In this case the unsafe call sits behind a dataset loader that users may reasonably treat as a routine data-reading step.
Malicious Dataset Loads Normally and Returns One Row
According to the researcher, loading the malicious file “completes normally and returns one row.” A victim running the load sees an ordinary result and nothing to indicate that code executed. The injected code can read files, environment variables and secrets on the machine, which in many machine-learning environments include cloud credentials and access tokens.
The repository accompanying the disclosure contains an exploit script, supporting evidence and a demo video. No exploitation in the wild has been reported.
Scale of the Hugging Face Datasets Library
The datasets library recorded about 38.4 million downloads in the past 30 days, according to PyPI Stats. That figure includes continuous integration and mirror traffic, so it overstates the number of distinct users, but it indicates how widely the package is installed in development and automated pipelines.
Machine-Learning Pipelines Handling Untrusted Datasets
The exposure concentrates in pipelines that load datasets from sources the operator does not control and that run with credentials attached. Training jobs, evaluation harnesses and notebook environments commonly hold cloud keys and tokens, and a data-loading step that runs attacker code inherits all of them.
Hugging Face’s ecosystem is built around sharing datasets and models between users, which makes loading third-party files a normal part of the workflow. A flaw triggered by a data file, not by a downloaded program, fits that workflow closely.
No Patch and Limited Mitigation Guidance
No fixed release is available. The only guidance attached to the disclosure is to avoid the pandas builder when handling untrusted data. Because the builder is deprecated but still registered, it remains reachable on current releases through 5.1.0.
The publication of a working exploit with no patch leaves a gap in which the technique is public and the library remains unchanged. It is not yet known whether the maintainers have acknowledged the report or when a fix might arrive. The case also joins a long line of pickle-related issues in machine-learning tooling, where the serialization format’s ability to execute code has produced repeated security findings in model and dataset loading. Whether attackers move from the published proof-of-concept to real attacks has not yet been reported.
Why the Deprecated Builder Remains a Risk in Release 5.1.0
The pandas builder is described as deprecated but still registered, a status that explains how it stays reachable. Deprecation signals that maintainers intend to remove a feature, yet registered code can still be invoked by name, and any user who selects it hands a file straight to the pickle reader.
The researcher’s package of material, with an exploit script, evidence files and a demo video, gives anyone the means to reproduce the result. That publication choice, made while no fixed release exists, raises the practical stakes for organizations whose pipelines load datasets they did not create.
The reported 38.4 million downloads over 30 days show how broadly the library is installed, but the source cautions that CI and mirror traffic inflate the count. The disclosure does not estimate how many installations use the vulnerable builder, and the sources do not indicate that any of the real-world pipelines loading untrusted data have been attacked.
