datasets: datasets: Arbitrary code execution via insecure pickle deserialization (CVE-2026-57845)

Overview

A flaw was found in datasets. This vulnerability allows an attacker to achieve arbitrary code execution by convincing a victim to load a maliciously crafted dataset file. Due to insecure deserialization—the process of restoring saved data back into program objects—untrusted data loaded through the pandas dataset builder is processed without validation. Consequently, opening a malicious file executes arbitrary Python code with the privileges of the running process.

Vendor advisories

• Red Hat VEX · Important · affected: Exploit Intelligence, Lightspeed Core, Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · no fix planned: Exploit Intelligence, Lightspeed Core, Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) 3, … · updated 2026-10-23 · vex

datasets: datasets: Arbitrary code execution via insecure pickle deserialization — rated Important by Red Hat. Released 2026-10-23.

Affected:

• Exploit Intelligence
• Lightspeed Core
• Red Hat AI Inference Server
• Red Hat Enterprise Linux AI (RHEL AI) 3
• Red Hat OpenShift AI (RHOAI)

No fix planned:

• Exploit Intelligence
• Lightspeed Core
• Red Hat AI Inference Server
• Red Hat Enterprise Linux AI (RHEL AI) 3
• Red Hat OpenShift AI (RHOAI)

Remediation

Affected