# Hugging Face Datasets: the pandas builder runs code from a dataset file

> A dataset file, not a model file, is enough to execute code when the deprecated pandas builder unpickles it.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability, Supply chain
- **Published by:** VulnCheck
- **Disclosed:** 2026-10-23
- **CVE:** CVE-2026-57845
- **CVSS:** 8.7
- **Affects:** Hugging Face Datasets, datasets (PyPI)
- **Research by:** [Sai Teja Erukude](https://github.com/SaiTeja-Erukude)
- **Primary source:** https://www.vulncheck.com/advisories/hugging-face-datasets-pickle-deserialization-rce-via-pandas-builder
- **Page:** https://theinjection.dev/items/hf-datasets-pandas-builder-pickle-rce/

CVE-2026-57845 lets a crafted pickle file run arbitrary Python when Hugging Face Datasets 5.1.0 or earlier loads it through the deprecated pandas builder. No fixed release exists, and the proposed patch is still open.

## What happened

VulnCheck published CVE-2026-57845 on October 23, 2026, crediting Sai Teja Erukude, who opened a proposed fix on the same day. The advisory covers Hugging Face Datasets 5.1.0 and every earlier version, and VulnCheck scores it 8.7.

## How it works

The deprecated pandas packaged builder hands the files named in data_files straight to pandas.read_pickle() without checking them. Python's pickle format lets an object define its own __reduce__ method, which the unpickler calls, so the payload executes while the file is being read. Code runs with the privileges of the process that called load_dataset.

## Who is affected

Exposure needs the deprecated pandas builder: a caller that reaches datasets.load_dataset("pandas", data_files=...) with a file it does not control. VulnCheck scopes the advisory to that builder, and release 5.1.0 of October 5, 2026 is still the newest version published.

## What to do

Stop passing untrusted files to the pandas builder, and convert stored pickles to Parquet or Arrow before loading them. Pull request 8879 on huggingface/datasets would make the builder raise an error before any file is opened, but it is unmerged, so there is no version to upgrade to yet.

## Quick facts

- **Affected:** Hugging Face Datasets 5.1.0 and earlier
- **CVE:** CVE-2026-57845
- **CVSS:** 8.7, CVSS 4.0, assigned by VulnCheck
- **Attack type:** Pickle deserialization through the pandas builder
- **Found by:** Sai Teja Erukude
- **Disclosed:** 23 October 2026
- **Status:** Unpatched, pull request 8879 open

## Questions

### Is there a patched version of Hugging Face Datasets for CVE-2026-57845?

No patched release of Hugging Face Datasets exists as of October 23, 2026. Version 5.1.0, published on October 5, remains the newest release on GitHub. Sai Teja Erukude opened pull request 8879, which would make the pandas builder raise an error before opening or unpickling any file, but the pull request is still open and unmerged.

### Am I affected if I only load Parquet or CSV datasets?

Loading Parquet, CSV, JSON or Arrow data falls outside the scope of CVE-2026-57845, which VulnCheck places only in the deprecated pandas packaged builder. The risky call is datasets.load_dataset with the pandas builder and a data file you do not control. Teams that never select that builder are not exposed by this advisory.

### How can I check whether my code uses the affected pandas builder?

Search your codebase for calls to datasets.load_dataset with "pandas" as the builder name, and for data_files arguments pointing at .pkl or .pickle files. VulnCheck's advisory names datasets.load_dataset("pandas", data_files=...) as the trigger. Pipelines that take a dataset path from user input or a remote hub listing deserve the closest look, because the file is then outside your control.

## Sources

1. [VulnCheck Advisory](https://www.vulncheck.com/advisories/hugging-face-datasets-pickle-deserialization-rce-via-pandas-builder)
2. [Proposed Fix PR](https://github.com/huggingface/datasets/pull/8879)
3. [Datasets Releases](https://github.com/huggingface/datasets/releases)