{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3ahuggingfacedatasets/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:huggingface:datasets:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-57845"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["datasets (\u003c= 5.1.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Hugging Face"],"content_html":"\u003cp\u003eA vulnerability (CVE-2026-57845) exists in the Hugging Face \u003ccode\u003edatasets\u003c/code\u003e library, specifically within the \u003ccode\u003edataset_module_factory\u003c/code\u003e pandas-based builder. The library uses \u003ccode\u003epandas.read_pickle()\u003c/code\u003e to process data files without proper validation. An attacker can supply a malicious pickle file that executes arbitrary code during the deserialization process when \u003ccode\u003eload_dataset()\u003c/code\u003e is invoked. The PoC demonstrates successful code execution by triggering a local file write upon loading a malicious pickle object. There is currently no upstream fix, PR, or confirmed patched release.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker prepares a malicious pickle object using the \u003ccode\u003e__reduce__()\u003c/code\u003e method to embed a payload.\u003c/li\u003e\n\u003cli\u003eAttacker hosts or supplies the malicious file as an input to the \u003ccode\u003eload_dataset()\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eVictim application invokes \u003ccode\u003edatasets.load_dataset()\u003c/code\u003e pointing to the malicious file.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003edataset_module_factory\u003c/code\u003e identifies the file and routes it to the \u003ccode\u003epandas\u003c/code\u003e packaged builder.\u003c/li\u003e\n\u003cli\u003eThe builder invokes \u003ccode\u003epandas.read_pickle()\u003c/code\u003e on the untrusted input.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003epickle\u003c/code\u003e module deserializes the object, triggering the attacker-supplied callable.\u003c/li\u003e\n\u003cli\u003eArbitrary code executes within the context of the application process.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in arbitrary code execution on the system running the \u003ccode\u003edatasets\u003c/code\u003e library. The PoC confirms that code execution occurs before the library attempts to convert the data into an Arrow table, rendering post-deserialization validation ineffective.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of the Hugging Face \u003ccode\u003edatasets\u003c/code\u003e library in production and development environments using automated inventory tools.\u003c/li\u003e\n\u003cli\u003eImmediately stop using pickle-formatted datasets from untrusted or external sources.\u003c/li\u003e\n\u003cli\u003eMigrate all data exchange to secure formats such as Parquet, Arrow, CSV, or JSON.\u003c/li\u003e\n\u003cli\u003eIf existing data must be moved, use \u003ccode\u003eDataset.from_pandas()\u003c/code\u003e with a trusted, already-loaded DataFrame rather than loading from disk via the \u003ccode\u003epandas\u003c/code\u003e builder.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation or access controls to prevent the loading of pickle files from arbitrary or internet-accessible locations.\u003c/li\u003e\n\u003cli\u003eMonitor logs for the execution of Python processes that import the \u003ccode\u003edatasets\u003c/code\u003e module and perform file operations in untrusted directories.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-23T03:20:38Z","date_published":"2026-10-23T03:20:38Z","id":"https://feed.craftedsignal.io/briefs/2026-10-hugging-face-datasets-pickle-rce/","summary":"The Hugging Face 'datasets' library is vulnerable to arbitrary code execution (CVE-2026-57845) due to insecure deserialization of untrusted data via the pandas builder.","title":"Hugging Face datasets: Arbitrary code execution via pickle deserialization (CVE-2026-57845)","url":"https://feed.craftedsignal.io/briefs/2026-10-hugging-face-datasets-pickle-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:huggingface:datasets:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}