Hugging Face Datasets: pickle-backed pandas builder executes code from a dataset file on load

Impact

The deprecated pandas packaged builder passes dataset files straight to pandas.read_pickle() with no validation, so a crafted pickle carrying a __reduce__ payload runs arbitrary Python the moment a user calls datasets.load_dataset("pandas", data_files=...). The code runs as the loading process, which on a GPU fleet is typically a training or preprocessing job with the dataset mounts, the GPUs, and whatever hub tokens, object-store keys and service credentials that job's environment carries. Anywhere datasets are pulled from a shared bucket or a community hub and loaded by an automated pipeline, this is remote code execution on the training node rather than a local-user problem. Affects Datasets through 5.1.0.

Who can reach it

Anyone who can place or substitute a dataset file that a job later loads - a hub repository, a shared bucket, a user-supplied data path. Requires a victim process to call load_dataset with the pandas builder; no authentication to the victim system.

What to do

Pin datasets to a release that carries the fix from PR 8879 and rebuild the job images; the advisory does not name a fixed version, so verify against the upstream changelog before relying on a number. In the meantime stop using the "pandas" builder on any data you did not produce, and block .pkl/.pickle data files in ingestion paths. Rolling this out means rebuilding and restarting training and preprocessing jobs, not rebooting nodes.

References

Related entries

• XAgent: path traversal in the workspace file endpoint reads any host file outside the Docker sandboxCVE-2026-72713 · XAgent (OpenBMB) workspace file endpoint `/workspace/file`High
• Xinference: model launch API executes attacker-supplied Python because trust_remote_code is always onCVE-2026-76841 · Xinference (Xorbits Inference) model loaders - trust_remote_codeHigh
• Coze Studio: any registered user gets code execution from a workflow code node by defaultCVE-2026-77934 · Coze Studio (workflow code node, unsandboxed python3 subprocess)High
• Ollama: model pull follows cross-host redirects, giving SSRF to internal and metadata endpointsCVE-2026-85180 · Ollama (tensor-layer blob download, cross-host redirect handling)High
• Axolotl: multipack patch loads Hugging Face base models with trust_remote_code=True, giving RCE on the training nodeCVE-2026-86169 · Axolotl (multipack patch path, trust_remote_code guard)High
• vLLM: rejected requests leak decode-worker metadata until the worker exhausts memoryCVE-2026-93436 · vLLM NIXL KV connector (decode-side metadata cleanup for rejected requests)High