CVE-2026-57845

Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed b...

CVE-2026-57845

Hugging Face Datasets version 5.1.0 is vulnerable to Remote Code Execution (RCE) via insecure deserialization. The root cause lies in the deprecated pandas packaged builder , which processes user-supplied data files through pandas.read_pickle() without validation. When a victim calls datasets.loa...

CVE-2026-57845 Hugging Face Datasets 5.1.0 Pickle Deserialization RCE via Pandas Builder

Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed b...

EUVD-2026-109092

Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed b...

CVE-2026-57845 Hugging Face Datasets 5.1.0 Pickle Deserialization RCE via Pandas Builder

Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed b...

PT-2026-122146

Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed b...

Arbitrary Code Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Arbitrary Code Injection in the CSVAgent process, where user-supplied input is used to construct Python code executed via pyodide. An attacker can execute arbitrary code by supplying a crafte...

Arbitrary Code Injection

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Arbitrary Code Injection in the CSVAgent process, where user-supplied input is used to construct Python code executed via pyodide. An attacker can execute arbitrary code by supplying a crafted payload that...

CVE-2026-69256

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.readpickle could deserialize a pickled...

CVE-2026-69256: Improper Control of Generation of Code

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.readpickle could deserialize a pickled...