Summary
Hugging Face Datasets can insecurely deserialize attacker-controlled pickle files through its deprecated pandas packaged builder. If a victim loads a malicious pickle-backed dataset with the pandas builder, embedded code may execute with the privileges of the victim process.
Hugging Face Datasets can insecurely deserialize attacker-controlled pickle files through its deprecated pandas packaged builder. If a victim loads a malicious pickle-backed dataset with the pandas builder, embedded code may execute with the privileges of the victim process.
Affected context
The vulnerability occurs in deployments using the pandas packaged builder and supplying dataset files that are processed through Pandas read_pickle() during table generation. Risk is present when an attacker can provide or influence a pickle-backed dataset and a victim or automated service invokes datasets.load_dataset("pandas", data_files=...) without independent trust validation.
The vulnerability occurs in deployments using the pandas packaged builder and supplying dataset files that are processed through Pandas read_pickle() during table generation. Risk is present when an attacker can provide or influence a pickle-backed dataset and a victim or automated service invokes datasets.load_dataset("pandas", data_files=...) without independent trust validation.
Exploit preconditions
- Attack surface: Dataset ingestion through the pandas packaged builder
- Required access: Ability to supply, replace, or influence a dataset file loaded by the victim process
- Trigger point: Processing the file through
Pandas._generate_tablesandpandas.read_pickle() - Why exploitation is possible: Pickle deserialization can invoke attacker-controlled object behavior, including
__reduce__logic, without validating the file as data-only content
- Attack surface: Dataset ingestion through the pandas packaged builder
- Required access: Ability to supply, replace, or influence a dataset file loaded by the victim process
- Trigger point: Processing the file through
Pandas._generate_tablesandpandas.read_pickle() - Why exploitation is possible: Pickle deserialization can invoke attacker-controlled object behavior, including
__reduce__logic, without validating the file as data-only content
Why this happens
The underlying bug is the use of Python pickle deserialization on an untrusted dataset file. Pickle is capable of reconstructing arbitrary Python objects and invoking embedded reduction functions during loading, meaning that parsing is not limited to passive data conversion. This behavior maps to CWE-502: Deserialization of Untrusted Data, because attacker-controlled serialized content is treated as trusted executable object state.
The underlying bug is the use of Python pickle deserialization on an untrusted dataset file. Pickle is capable of reconstructing arbitrary Python objects and invoking embedded reduction functions during loading, meaning that parsing is not limited to passive data conversion. This behavior maps to CWE-502: Deserialization of Untrusted Data, because attacker-controlled serialized content is treated as trusted executable object state.
Potential impact
- Arbitrary Python code may execute in the victim process
- Attackers could access data, credentials, or files available to that process
- The affected workload could be modified, disrupted, or used for persistence
- Compromised services could facilitate lateral movement depending on runtime permissions
- Dataset integrity and downstream machine-learning workflows could be affected
- Arbitrary Python code may execute in the victim process
- Attackers could access data, credentials, or files available to that process
- The affected workload could be modified, disrupted, or used for persistence
- Compromised services could facilitate lateral movement depending on runtime permissions
- Dataset integrity and downstream machine-learning workflows could be affected
General mitigation guidance
Mitigation generally focuses on eliminating unsafe deserialization of untrusted dataset content and reducing trust in externally supplied files.
Common defensive patterns include:
- Prefer data-only formats and parsers that do not execute object reconstruction logic
- Avoid pickle-backed dataset ingestion for untrusted or externally sourced files
- Enforce explicit file-format allowlists and content validation before processing
- Separate dataset acquisition from high-privilege application workloads
- Run ingestion processes with least-privilege filesystem, network, and credential access
- Apply sandboxing or isolation when legacy serialized formats cannot be removed
- Require provenance, integrity verification, and review for dataset artifacts
Mitigation generally focuses on eliminating unsafe deserialization of untrusted dataset content and reducing trust in externally supplied files.
Common defensive patterns include:
- Prefer data-only formats and parsers that do not execute object reconstruction logic
- Avoid pickle-backed dataset ingestion for untrusted or externally sourced files
- Enforce explicit file-format allowlists and content validation before processing
- Separate dataset acquisition from high-privilege application workloads
- Run ingestion processes with least-privilege filesystem, network, and credential access
- Apply sandboxing or isolation when legacy serialized formats cannot be removed
- Require provenance, integrity verification, and review for dataset artifacts
How teams detect issues like this
Organizations can identify similar risks through:
- Static analysis rules for
pickle,pandas.read_pickle(), and equivalent unsafe deserialization APIs - Code review checks for dataset loaders that accept attacker-controlled or externally sourced files
- Dependency and configuration policies that flag deprecated packaged builders or pickle-based ingestion
- Runtime monitoring for unexpected child processes, file access, or network activity during dataset loading
- CI policy enforcement requiring approved data formats and documented trust boundaries
- Automated security review tools that detect unsafe deserialization patterns and untrusted input flows
Organizations can identify similar risks through:
- Static analysis rules for
pickle,pandas.read_pickle(), and equivalent unsafe deserialization APIs - Code review checks for dataset loaders that accept attacker-controlled or externally sourced files
- Dependency and configuration policies that flag deprecated packaged builders or pickle-based ingestion
- Runtime monitoring for unexpected child processes, file access, or network activity during dataset loading
- CI policy enforcement requiring approved data formats and documented trust boundaries
- Automated security review tools that detect unsafe deserialization patterns and untrusted input flows
