datasets vulnerabilities
CVEs whose affected-version data names the datasets package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-57845High· 8.8PoCHugging Face Datasets through 5.1.0 Pickle Deserialization RCE via Pandas Builder
Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Atta…
▾ Midnighthuggingface · datasetsEPSS 0.55%via CVEORG
CVE-2026-65010Medium· 6.6PoCDatasets Symlink-following Arbitrary File Write via Extractor.extract()
Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract() that allows local attackers to write arbitrary files by pre-planting symlinks at predictable output paths. Attackers can re…
▾ Twilighthuggingface · datasetsEPSS 0.17%via CVEORG