CVE-2026-57845 | Hugging Face Datasets up to 5.1.0 Builder pandas.read_pickle data_files deserialization

October 23, 2026 Yanac

A vulnerability identified as critical has been detected in Hugging Face Datasets up to 5.1.0. Affected by this issue is the function pandas.read_pickle of the component Builder. The manipulation of the argument data_files leads to deserialization.

This vulnerability is uniquely identified as CVE-2026-57845. The attack is possible to be carried out remotely. No exploit exists.VulDB Recent EntriesRead More