The vulnerability in Hugging Face Datasets version 5.1.0 stems from insecure deserialization of pickle objects when using the deprecated pandas builder. This flaw allows an attacker to embed a malicious __reduce__ payload in a pickle file that is then processed by pandas.read_pickle() during the generation of tables. When a victim executes datasets.load_dataset("pandas", data_files=...), the embedded payload runs with the privileges of the victim process, leading to arbitrary Python code execution. The issue is a classic example of insecure deserialization (CWE‑502) and can be exploited without required authentication, as any user who loads a malicious dataset would be affected.

Affected systems are installations of Hugging Face Datasets up to and including version 5.1.0. Any user who employs the deprecated pandas builder to load datasets from files that might originate from untrusted sources is at risk. The product is distributed by the huggingface organization.

The CVSS score of 8.7 signifies high impact, while an EPSS score is not available but the vulnerability was publicly reported, indicating potential exploitation tools may exist. The flaw is currently not listed in the CISA KEV catalog. Attackers can exploit the flaw by supplying a crafted pickle file to a victim application that calls load_dataset with the pandas builder. Because the deserialization step occurs in user code with minimal input validation, there is no barrier to execution, making the vulnerability exploitable in environments where the victim code runs with sufficient privileges.