PoC exposes RCE flaw in widely used Hugging Face Datasets

A PoC has been published for a remote code execution flaw in Hugging Face Datasets, identified as CVE-2026-57845, with a CVSS score of 8.8. The researcher Sai Teja Erukude released full details and a working proof-of-concept for the vulnerability, which affects every datasets release up to and including version 5.1.0. PyPI statistics cited by the report estimate about 38.4 million downloads of the library in the past 30 days.

The issue centres on the deprecated but still registered pandas builder, which passes user-supplied files directly into pickle deserialization. A crafted pickle file can execute Python code when loaded, with the attacker’s payload running before Arrow conversion or feature validation. The PoC demonstrates that loading can complete normally while quietly executing code, and it requires user interaction to load the malicious dataset.

The advisory notes that there is no fixed release yet, and no confirmed exploitation has been observed in the wild. Affected component is listed as Hugging Face datasets 5.1.0 and earlier, via the datasets.packaged_modules.pandas[.]pandas path. Evidence includes the exploit script, saved data, and a demonstration video now present in the public repository. Mitigation proposed by the project includes Hugging Face datasets pull request #8879, which would make the pandas builder raise an error before opening any file.

Until a fix ships, vendors advise avoiding pickle-backed datasets from untrusted sources and using alternative builders such as Parquet, Arrow, CSV or JSON, with untrusted inputs loaded in isolated, low-privilege environments.