CVE-2026-57845: Loading a dataset with Hugging Face Datasets' pandas builder can run attacker code
Hugging Face Datasets through 5.1.0 unpickles files passed to its deprecated pandas builder without any check. If you call load_dataset("pandas", data_files=...) on a pickle file an attacker made, their code runs with your process's permissions. A fix is open as a pull request but no patched release exists yet.
What it is
The pandas packaged builder reads data files with pandas.read_pickle() inside Pandas._generate_tables, and pickle runs whatever a file's __reduce__ method tells it to.
So a pickle-backed dataset from an untrusted source turns load_dataset("pandas", data_files=...) into code execution on the machine or notebook that loads it.
A public write-up and proof of concept exist. The proposed fix (pull request 8879) makes the pandas builder refuse to open files at all and points users to a migration path.
How to check
- Affected: the datasets package (PyPI) through 5.1.0, the latest release at the time of writing.
- You are exposed only if your code, notebook or pipeline uses the "pandas" builder, or loads datasets where someone else controls which pickle files get read.
How to fix
- Don't use load_dataset("pandas", ...) on files you didn't create yourself. Convert trusted pickles to Parquet, CSV or Arrow and load those instead.
- Watch the datasets releases and upgrade once a version with the fix from pull request 8879 ships.
- Treat any pickle file from the internet as code, not data.
pip show datasets | grep -i version
grep -rn 'load_dataset("pandas"' .