Datasets
Monthly
Deserialization of attacker-supplied pickle data in the deprecated pandas packaged builder of Hugging Face Datasets (all versions through 5.1.0) lets a crafted dataset file run arbitrary Python in the victim's process when it is loaded via datasets.load_dataset("pandas", data_files=...). The attacker needs no credentials but does need the victim to actively point the loader at the malicious .pkl/.pickle file, and the builder emits a FutureWarning that it is deprecated; the resulting code executes with the privileges of the loading process, giving high confidentiality, integrity and availability impact. A public PoC reference exists but is not verified as working exploit code, there is no confirmed active exploitation, and the vendor fix (pull request 8879) hard-disables pickle loading in this builder; priority guidance places remediation in the current week rather than as an emergency.
Path traversal in Hugging Face Datasets up to 5.0.0 allows attackers to read arbitrary local files when a victim processes a crafted dataset. A publicly available exploit exists (CVE-2026-66007), though EPSS exploitation probability is low at 0.52% and user interaction is required. Patched in commit f989ef9.
Symlink following in HuggingFace Datasets through version 5.00 allows local low-privileged attackers to redirect archive extraction to arbitrary filesystem locations by pre-planting symlinks at predictable output paths in the shared cache directory. When a higher-privileged user or automated service subsequently triggers Extractor.extract(), the library writes archive contents through the attacker-controlled symlink, enabling overwrite of sensitive system files and potential privilege escalation or code execution. A publicly available exploit exists and an upstream fix is available via commit ad2d853, though no confirmed tagged release version has been independently verified.
Deserialization of attacker-supplied pickle data in the deprecated pandas packaged builder of Hugging Face Datasets (all versions through 5.1.0) lets a crafted dataset file run arbitrary Python in the victim's process when it is loaded via datasets.load_dataset("pandas", data_files=...). The attacker needs no credentials but does need the victim to actively point the loader at the malicious .pkl/.pickle file, and the builder emits a FutureWarning that it is deprecated; the resulting code executes with the privileges of the loading process, giving high confidentiality, integrity and availability impact. A public PoC reference exists but is not verified as working exploit code, there is no confirmed active exploitation, and the vendor fix (pull request 8879) hard-disables pickle loading in this builder; priority guidance places remediation in the current week rather than as an emergency.
Path traversal in Hugging Face Datasets up to 5.0.0 allows attackers to read arbitrary local files when a victim processes a crafted dataset. A publicly available exploit exists (CVE-2026-66007), though EPSS exploitation probability is low at 0.52% and user interaction is required. Patched in commit f989ef9.
Symlink following in HuggingFace Datasets through version 5.00 allows local low-privileged attackers to redirect archive extraction to arbitrary filesystem locations by pre-planting symlinks at predictable output paths in the shared cache directory. When a higher-privileged user or automated service subsequently triggers Extractor.extract(), the library writes archive contents through the attacker-controlled symlink, enabling overwrite of sensitive system files and potential privilege escalation or code execution. A publicly available exploit exists and an upstream fix is available via commit ad2d853, though no confirmed tagged release version has been independently verified.