CVE-2026-57845
CVE-2026-57845 · Hugging Face Datasets through 5.1.0 Pickle Deserialization RCE via Pandas Builder
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed by Pandas._generate_tables via pandas.read_pickle() without validation, so when a victim calls datasets.load_dataset("pandas", data_files=...), the embedded __reduce__ payload executes code with the victim process's privileges.
CVSS 8.7 · Élevée · EPSS 0,5% · Code d’exploitation public
- Publication
- Mise à jour
Produits et versions concernés
datasets
- Versions du logiciel
- ≥ 0, ≤ 5.1.0: Concernée (semver)
Aucun correctif publié