Attack Chain

1. Attacker prepares a malicious pickle object using the __reduce__() method to embed a payload.
2. Attacker hosts or supplies the malicious file as an input to the load_dataset() function.
3. Victim application invokes datasets.load_dataset() pointing to the malicious file.
4. The dataset_module_factory identifies the file and routes it to the pandas packaged builder.
5. The builder invokes pandas.read_pickle() on the untrusted input.
6. The pickle module deserializes the object, triggering the attacker-supplied callable.
7. Arbitrary code executes within the context of the application process.

Impact

Successful exploitation results in arbitrary code execution on the system running the datasets library. The PoC confirms that code execution occurs before the library attempts to convert the data into an Arrow table, rendering post-deserialization validation ineffective.

Recommendation

• Identify all instances of the Hugging Face datasets library in production and development environments using automated inventory tools.
• Immediately stop using pickle-formatted datasets from untrusted or external sources.
• Migrate all data exchange to secure formats such as Parquet, Arrow, CSV, or JSON.
• If existing data must be moved, use Dataset.from_pandas() with a trusted, already-loaded DataFrame rather than loading from disk via the pandas builder.
• Implement strict input validation or access controls to prevent the loading of pickle files from arbitrary or internet-accessible locations.
• Monitor logs for the execution of Python processes that import the datasets module and perform file operations in untrusted directories.