https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 02 Nov 2026 08:39:13 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-57845 <p>Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed by Pandas._generate_tables via pandas.read_pickle() without validation, so when a victim calls datasets.load_dataset(&#34;pandas&#34;, data_files=...), the embedded __reduce__ payload executes code with the victim process&#39;s privileges.</p> <p>Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed by Pandas._generate_tables via pandas.read_pickle() without validation, so when a victim calls datasets.load_dataset(&#34;pandas&#34;, data_files=...), the embedded __reduce__ payload executes code with the victim process&#39;s privileges.</p> https://db.gcve.eu/vuln/fkie_cve-2026-57845 https://db.gcve.eu/vuln/ghsa-9hc7-p88p-mwm8 <p>Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed by Pandas._generate_tables via pandas.read_pickle() without validation, so when a victim calls datasets.load_dataset(&#34;pandas&#34;, data_files=...), the embedded __reduce__ payload executes code with the victim process&#39;s privileges.</p> <p>Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed by Pandas._generate_tables via pandas.read_pickle() without validation, so when a victim calls datasets.load_dataset(&#34;pandas&#34;, data_files=...), the embedded __reduce__ payload executes code with the victim process&#39;s privileges.</p> https://db.gcve.eu/vuln/ghsa-9hc7-p88p-mwm8