huggingface/datasets vulnerabilities

Latest huggingface/datasets CVEs

Newest publication first

1. CVE-2026-57845 Hugging Face Datasets < 5.2.0 Pickle Deserialization RCE via Pandas Builder

   Published 2026-10-23

   High·CVSS 8.7 EPSS 0.55%

   Hugging Face Datasets before 5.2.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset tha...

2. CVE-2026-66007 Datasets Path Traversal via Unsanitized file_name Metadata

   Published 2026-07-24

   Medium·CVSS 6.9 EPSS 0.55%

   Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.